Logstash vs Sumo Logic

Logstash is an open-source, server-side pipeline that collects data from many sources, transforms events, and sends results to destinations. It can continuously ingest logs, metrics, web application data, data-store information, and AWS service data. Filters parse events, identify fields, and transform content with features such as grok parsing, IP geolocation, and anonymizing or excluding sensitive fields. Data can go to multiple outputs, including Elasticsearch. Its plugin framework includes more than 200 input, filter, and output plugins, and custom plugins can be built with an API and generator. Persistent queues provide at-least-once delivery for in-flight events after node failures; dead letter queues retain events for inspection and replay. Monitoring tools show pipeline performance and availability. Logstash supports log pipelines, archive export, live tailing, and structured parsing. It is self-hosted, with Linux packages and Docker listed. The free plan is free under the Elastic License.

Sumo Logic is a cloud log management service accessed through the web. Its listed capabilities include log pipelines, structured log parsing, live log tailing and archive export. The Free plan also covers metrics and traces, with 20 daily credits for logs, metrics and traces, seven-day log retention and access for up to three users. A separate Trial plan is available at no charge for 30 days, allowing 1 GB per day, 30-day retention and up to 20 users. For continued paid use, Essentials is a credits-based subscription for log analytics and monitoring; customers can upgrade their accounts themselves and choose a billing cycle. Enterprise Suite is described as an enterprise plan for security teams, with pricing via sales. Sumo Logic was founded in 2010 and is headquartered in Redwood City, California, United States. The listed deployment is cloud, and the listed platform is web.