No more typing reviews! Try our Samantha, our new voice AI agent.

LogRhythm SIEM vs Logstash comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

LogRhythm SIEM
Ranking in Log Management
11th
Average Rating
8.2
Reviews Sentiment
6.4
Number of Reviews
176
Ranking in other categories
Security Information and Event Management (SIEM) (13th)
Logstash
Ranking in Log Management
29th
Average Rating
9.0
Reviews Sentiment
5.6
Number of Reviews
5
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of September 2026, in the Log Management category, the mindshare of LogRhythm SIEM is 3.0%, up from 2.2% compared to the previous year. The mindshare of Logstash is 0.8%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Mindshare Distribution
ProductMindshare (%)
LogRhythm SIEM3.0%
Logstash0.8%
Other96.2%
Log Management
 

Featured Reviews

RS
Engineer Information Security at N-Able (Pvt) Ltd
Advanced threat detection has improved investigations but complexity and resource use need refinement
LogRhythm SIEM could learn from Wazuh, as Wazuh has a built-in mechanism that allows you to write custom scripting and scripts through languages that Wazuh can then trigger, which is somewhat better and more matured in Wazuh compared to LogRhythm SIEM. Additionally, the parsers that I write for LogRhythm SIEM tend to get quite complex for log parsing, while with Wazuh, I can achieve a similar parser with much less complexity. Those are some of the pain points that some of our customers have been expressing. If LogRhythm SIEM could make a lightweight version of their solution, that would be quite competitive because some of my customers have a very large need but refuse to go with LogRhythm SIEM due to its complexity and high resource intensity. Therefore, they have been moved to Wazuh, which I am deploying for them. Even though LogRhythm SIEM has extremely good capabilities, their resource utilization is too heavy for certain customers, so if they could make a separate, lightweight version, that would be quite beneficial.
Mohammed-Abdelalim - PeerSpot reviewer
Assistant Vice President at QualityKiosk Technologies Pvt. Ltd.
Exploring resilience and integration capabilities while navigating complexity and technical challenges
Logstash lacks a graphical user interface, necessitating a strong programming background to handle it effectively. It is challenging for business users who need a skilled team for its operation. Changing pipelines is not easy because Logstash requires pipelines to be programmed and cannot just be dragged and dropped like other data solutions. Additionally, Logstash does not automatically make actions based on the data it receives; integrating automation tools is required.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Customer Service: It's the best there is. Technical Support: It's the best there is."
"LogRhythm NextGen SIEM is customizable, simple to manage, and there are many features, and the solution does not require an expert to be able to use it, anyone can use it."
"We went through a competitive comparison of the three leading platforms out there, and it was an easy win, not only from the technology side, but from the company with its support."
"I would say the most valuable feature of LogRhythm is that it has built-in UEBA functionality, among other basic Windows packages."
"The AI Engine can take an event and correlate it into something else giving us meaningful context regarding what is going on. We integrated it in with our ticketing system, so if an alarm fires, it raises a ticket in our system."
"The ability for me to go into the Web UI, and just learn what's going on in my environment."
"The consolidation of the logs and being able to manage the items we have coming in -- all in one product -- has really helped this company a lot."
"We raise a ticket to LogRhythm, and they will give us their support."
"The functionality of Logstash is quite easy to implement and the plugin ecosystem of Logstash is great, with plugins for shell script monitoring and SQL monitoring working well with the tool."
"I can collect logs from various data sources, including hardware."
"Logstash has numerous plugins for inputs and outputs, allowing it to work well in environments that do not contain other Elastic components."
"The transformation means we ship the logs in the way that we want them to be presented in Kibana, which is the main function we use Logstash for."
"Everything aligns well with improving our organization."
"We have three or four Logstash servers for high availability."
 

Cons

"We had a little bit of difficulty implementing a disaster recovery situation because it was leveraging only Microsoft native DNS and it wouldn't work with our Infoblox DNS deployment that we use in our environment. They've been working on that behind the scenes."
"It is a little hard to get integrated."
"It’s very easy to overwhelm the system. I have some of the beefiest data that they provide, and I can still overrun the system."
"When we had version 7.2.6, there were a lot of issues deploying that version and with the indexing. The indexer was unstable. So, we were not able to use the platform when we were on that version until we were able to upgrade to 7.3.4."
"I think they probably need to, because a lot of companies are having this cloud-first strategy, where anything that's new has to go into the cloud for some reason."
"Setting up LogRhythm SIEM is complex. Everything is complicated — the activity, integration, and analysis."
"The initial setup is complex and I rate it a six out of ten."
"Sometimes it's a challenge to bring it to the second level of support and get the answers that we need."
"Elastic does not provide proper support for Logstash worldwide, and I rate their technical support as one out of ten."
"There can be a UI to implement with Logstash. Currently, I have to work with config files and everything."
"Almost all the research can be very bad. We still have a problem with importing the log system."
"An enhancement we could implement is the ability to cluster Logstash to exist in more than one node."
"The product needs to improve its compatibility."
 

Pricing and Cost Advice

"If you don't have your staff, absolutely look into the co-pilot and factor that into your cost evaluation."
"On a scale of one to ten, I'd rate the pricing of this solution as a seven - not too expensive but not cheap either. Regarding licensing costs, it varies depending on factors like being a partner or an end user, but there are no additional costs aside from standard licensing fees for the basic SIEM solution."
"Look for whatever will give you the most value. That's the main point. It is not one size fits all."
"The license cost is around $10 per MPS."
"We have seen a measurable decrease in the mean time to detect and respond to threats. As it comes out new features and new releases, the window is becoming a lot narrower because you can pivot a lot more with the data. Therefore, the new features and enhancements are reducing that."
"When it comes time to renew, they say, "This is what you are using. This is what we can do for you." So, they work with you on pricing."
"I would rate the pricing 4 out of 5. There are no additional costs to the standard licensing fees."
"I would recommend talking to the rep. That's the biggest thing because they will know what questions to ask."
Information not available
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
913,806 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
12%
Outsourcing Company
10%
Financial Services Firm
9%
Comms Service Provider
8%
Financial Services Firm
17%
University
8%
Comms Service Provider
8%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business38
Midsize Enterprise39
Large Enterprise83
No data available
 

Questions from the Community

What is the difference between log management and SIEM?
Rony, Daniel's answer is right on the money. There are many solutions for each in the market, a lot depends upon your ability to manage such tools and your budget. A small operation may be best s...
What needs improvement with LogRhythm NextGen SIEM?
LogRhythm SIEM could learn from Wazuh, as Wazuh has a built-in mechanism that allows you to write custom scripting and scripts through languages that Wazuh can then trigger, which is somewhat bette...
What is your experience regarding pricing and costs for LogRhythm SIEM?
I find LogRhythm SIEM affordable, as it is a bit less costly than QRadar, although I have not been involved in negotiation charges; however, from the manager's approval, I see it as affordable.
What needs improvement with Logstash?
Customization can be automated with Logstash, but it is at the developer's disposal. The developer has to do it, not the tool as such. There is scope for optimization, but that is all outside the t...
What is your primary use case for Logstash?
The purposes for which I am using Logstash largely include log aggregation and application monitoring.
What advice do you have for others considering Logstash?
I am using Logstash for log management and also implement it. Logstash can be deployed both on-cloud and on-premises. On a scale of 1-10, I rate Logstash an 8.
 

Comparisons

 

Also Known As

LogRhythm NextGen SIEM, LogRhythm, LogRhythm Threat Lifecycle Management, LogRhythm TLM
No data available
 

Overview

 

Sample Customers

Macy's, NASA, Fujitsu, US Air Force, EY, Abbott, HD Supply, SAB Miller, UCLA, Raytheon, Amtrak, Cargill
Information Not Available
Find out what your peers are saying about LogRhythm SIEM vs. Logstash and other solutions. Updated: September 2026.
913,806 professionals have used our research since 2012.