Elasticsearch is a fantastic search and analytics platform. It’s easy to use as a SIEM tool, and creating exceptions is straightforward. I really appreciate the ECS field schemes, the agent/fleet/integrations setup, and the quality of support. These features make the platform flexible and enjoyable to work with.

i use elastic every day with our siem

it's easy to setup without certificates Review collected by and hosted on G2.com.

The documentation could be improved—especially around “detection as code,” which is difficult to set up and barely documented. Having “exceptions as code” would also be a great addition. I miss certain features that competitors like Wazuh provide, such as a built-in vulnerability scanner. Another gap is the lack of community-driven blogs and integration examples (like those published on Medium by SOCFortress for Wazuh). Finally, I find it strange that certain wildcard searches (e.g., *test* across large datasets like Palo Alto logs) can crash the entire stack.

i would expect for small bussiness, there should be an automatic rotation and trust for certificates between clients and fleet server, our between nodes. Review collected by and hosted on G2.com.

Elasticsearch is extremely fast, scalable, and reliable for handling large amounts of data. I’ve used it extensively for log management, search queries, and analytics, and it consistently delivers results in near real-time. Its flexibility with queries, index lifecycle management, and clustering makes it an essential part of our infrastructure. The ecosystem around Elasticsearch (APIs, integrations, documentation) makes it easy to extend and adapt to different use cases. Review collected by and hosted on G2.com.

Managing clusters at scale can sometimes be challenging, especially around balancing shards, force merge operations, and handling 429 rate-limit responses. While it’s very powerful, certain advanced operations require deep knowledge to avoid performance bottlenecks. That said, once tuned properly, it works extremely well and reliably. Review collected by and hosted on G2.com.

It simply works as expected and is blazingly fast. Using the ELK stack has been a life changer as well. Lots of features have been added over the years (working with Elasticsearch for a lot of years now). Worth mentioning is that the documentation is top notch. Very well structured, easy to understand and with lots of examples. Review collected by and hosted on G2.com.

In all these years that I have been using Elasticsearch, I did not find a single thing I actually missed. It's a complete package that delivers all that I am looking for. Review collected by and hosted on G2.com.

I use Elastic on a daily basis, and the visualization and log exploration features are very enjoyable and user-friendly once you get to know the solution. Fleet allows for a simple way to add agents, even in offline implementations, and the documentation in this context is very good. Elastic SIEM is also pleasant to use, but it’s important to keep in mind the retention of Elastic events and processes, as they can take up a lot of storage. The support is very good, although the AI chat is not always useful since it can sometimes point to outdated articles. Review collected by and hosted on G2.com.

Overall, I’m very satisfied with Elastic, but the biggest downside for me is the documentation. It’s often unclear or incomplete, especially when it comes to Elastic Agent and all the integrations. This makes setup and troubleshooting more complicated than it should be. One of the challenges I faced is with log parsing in the TCP custom input integration. The documentation is not very clear, and it’s not always obvious which preprocessors can be used or how to configure them properly. Of course, I should be using pipelines, but since Elastic provides such a solution, it should be properly documented. Sometimes even when debugging pipelines, not everything is clear or easy to understand. Review collected by and hosted on G2.com.

APM feature, I like the APM feature in Elastic which helps to identify the endpoints failing or services which were not healthy at any point of time. The way it shows the failure transaction, latency throughput and mapping with services is useful in my daily works. The dependencies feature is great addon to identify what other services are being affected due to the issue. Review collected by and hosted on G2.com.

Searching for aged logs. In one of our clusters, it is hard for us to get the aged logs when we search with any pattern. Don't think this is fully due to Elastic it has more to do with our logs and tier configuration too. Also getting the logs and metrics of database server is something I feel hard. Review collected by and hosted on G2.com.

Elasticsearch is a mature product with high levels of performance and is very flexible. Able to be tuned for accurate lexical search but also supports semantic search. The Cloud Hosted option helps to abstract away much of the infrastructure management and also has an AutoOps feature to help identify issues with indexing or searching. Working closely with their knowledgeable product team helped to ease the implementation of our solution. Review collected by and hosted on G2.com.

It is very API-centric and although the Kibana interface continues to improve and add management features, if the end-users are not very technical, they will need support with some of the management activities. Also, if you need to use the Elasticsearch web crawlers for indexing web pages, version 9 moves away from the Elastic-hosted crawlers so you will need to run the Open Crawler on your own infrastructure. Review collected by and hosted on G2.com.

Elasticsearch provides extremely fast and powerful search capabilities, even on very large datasets. I like how flexible it is with indexing and querying structured as well as unstructured data. Its ability to handle full-text search, filtering, and aggregations makes it ideal for analytics and real-time monitoring. Integration with Kibana adds strong visualization support, helping us easily explore trends and patterns. The distributed nature of Elasticsearch ensures scalability, making it suitable for high-volume production systems. It is also very easy to integrate with different applications and data pipelines, which makes adoption smooth across teams. Implementation is straightforward, with clear documentation and community support that reduces the learning curve. Customer support is also excellent. In my organization, we use it very frequently as all the logs, service traces, and errors are centralized in Elasticsearch for debugging and monitoring. Review collected by and hosted on G2.com.

While Elasticsearch is powerful, it can be resource-intensive and requires careful configuration to avoid performance bottlenecks. Setting up clusters and managing shard allocation can sometimes be tricky for beginners. Query syntax, while flexible, can feel complex for new users. Also, as the data size grows, managing indexes and optimizing queries requires ongoing effort. Review collected by and hosted on G2.com.

From our use, Elasticsearch is fast, scalable and provides quick results for querying which makes it very useful for any log analysis Review collected by and hosted on G2.com.

Operational cost is increasing

Shard allocation and indexing can be made easier to configure Review collected by and hosted on G2.com.

Everything from handling ingestion to observability + ML + SIEM +XDR + reporting Review collected by and hosted on G2.com.

it is good and bad in the same time , it is hard to follow all new features at time.

plus if more concret application is added o doc this would be great for better understanding of functialities Review collected by and hosted on G2.com.

I like best how Elasticsearch handles large amounts of data in a scalable and efficient manner, making it easier to manage and scale as my data grows. Additionally, the extensive community support and integration with other tools make it a valuable addition to my data processing workflow. Review collected by and hosted on G2.com.

While I appreciate the many benefits Elasticsearch provides, some drawbacks include the steep learning curve, potential complexity in management and maintenance, and the risk of performance overhead. Additionally, ensuring security configurations and managing data consistency issues are crucial to avoiding potential data loss or corruption. Review collected by and hosted on G2.com.