On Wed, 21 Jan 2026, at 05:43, Martin Schröder wrote: > Am Di., 20. Jan. 2026 um 19:35 Uhr schrieb Tom Smyth > <[email protected]>: > Tools like Graylog, Loki and Elasticsearch/Kibana exist.
Yes. This. Combined with something like Fluent-bit. Have used Graylog at reasonable scale (hundreds of VMs, thousands of deployed application instances) and it worked pretty well. People seemed to get along pretty well with the search interface. Cannot overstate the importance of user interface here. Reading between the lines… it seems like your use case is probably to reduce the rate of support requests arriving in _your_ inbox? If people hate it, it’s not going to help you. Elasticsearch hosting cost[1] can get pretty significant at that scale. It also tends to cost a lot for small-moderate scale if you observe their best practices. I would expect this to remain true regardless of the frontend app (Graylog, Kibana, etc) There are outsourced providers for this, including Elasticsearch themselves. This has ups and downs. One significant up being that you can read logs when shit is broken. If you do consider using such a provider, make sure the network traffic cost/impact will be acceptable. At $oldwork we considered using Newrelic for logs … until I calculated the AWS network egress cost. Instant dealbreaker. It would have cost more than all the combined Elasticsearch and Graylog compute/storage [1] I was using AWS, but I don’t think the provider influences this very much John
