Logstash vs syslog-ng
Logstash
elastic.cosyslog-ng
syslog-ng.comSide by side
| Figure | Logstash | syslog-ng |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | Yes |
| Open source | — | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 6 |
| Spec score · Log Management Software | 8.5 (#25) | 9.1 (#11) |
| Spec score · Telemetry Pipeline Software | 8.1 (#14) | 8.7 (#2) |
| Compliance | Elastic's Trust Center lists certifications and standards including FedRAMP, PCI DSS, ISO/IEC 27001, SOC 2, and HIPAA. | Commercial documentation describes logstore and reliable transfer features as helping with SOX, HIPAA and PCI-DSS collection requirements. |
| Free plan | Yes | Yes |
| Installation | The download page lists Linux x86_64, apt and yum package managers, and Docker containers. | OSE can be installed from Debian/Ubuntu, RHEL, Fedora and Arch packages, official repositories, Docker images or source compilation. |
| Integrations | Elastic describes turn-key integrations for connecting data sources and ingesting logs, metrics, traces, files, web content, and security events. | The product pages list destinations and integrations including Elasticsearch, Hadoop, Kafka, MongoDB, SQL databases, Redis, Splunk, and SIEM tools. |
| Purpose | Logstash is an open source server-side data processing pipeline that ingests data from multiple sources, transforms it, and sends it to a destination. | syslog-ng collects logs from infrastructure sources, processes them, and routes or stores them for analysis. |
| Reliability | Persistent queues provide at-least-once delivery for in-flight events if nodes fail, and a dead letter queue can hold events for inspection and replay. | Premium Edition uses disk buffering, client-side failover, and application-layer acknowledgement to help transfer logs without message loss. |
| Security | The product page says ingest pipelines can be secured and describes built-in security features for Pipeline Management UI controls. | Premium Edition supports TLS-encrypted transfer and encrypted log storage, with X.509 certificates for host and server mutual authentication. |
Plans
syslog-ng
- syslog-ng Open Source EditionFree
- syslog-ng Premium Edition trialFree
- Syslog-ng Basic$2,800, paid once
- syslog-ng Premium EditionPriced on request
- syslog-ng Premium Edition MarketplacePriced on request
- syslog-ng Store BoxPriced on request
In their own words
Logstash
Logstash is an open-source, server-side pipeline that collects data from many sources, transforms events, and sends results to destinations. It can continuously ingest logs, metrics, web application data, data-store information, and AWS service data. Filters parse events, identify fields, and transform content with features such as grok parsing, IP geolocation, and anonymizing or excluding sensitive fields. Data can go to multiple outputs, including Elasticsearch. Its plugin framework includes more than 200 input, filter, and output plugins, and custom plugins can be built with an API and generator. Persistent queues provide at-least-once delivery for in-flight events after node failures; dead letter queues retain events for inspection and replay. Monitoring tools show pipeline performance and availability. Logstash supports log pipelines, archive export, live tailing, and structured parsing. It is self-hosted, with Linux packages and Docker listed. The free plan is free under the Elastic License.
syslog-ng
syslog-ng collects infrastructure logs, processes them, and routes or stores them for analysis. Its free Open Source Edition can collect, parse, classify, rewrite, and correlate logs before sending them to analysis tools or storing them. Premium Edition adds filtering and real-time pattern correlation to reduce and normalize log data, plus disk buffering, client-side failover, and application-layer acknowledgements. It supports TLS-encrypted transfer and encrypted log storage with X.509 certificates for mutual authentication. Store Box offers access-controlled search and custom reports that can help with compliance work. Listed destinations include Elasticsearch, Hadoop, Kafka, MongoDB, SQL databases, Redis, Splunk, and SIEM tools. Premium licensing is based on Log Source Hosts, with annual support available; Store Box licensing depends on Log Source Hosts and hardware configuration. Open Source Edition is GPL/LGPL licensed and community supported. Commercial customers can access certified engineers and support services; Premium Edition and Store Box offer free trials.