Logs management 2026: Loki, ELK, OpenSearch

Logs management in 2026 is dominated by 3 main stacks: Grafana Loki (cheap label-based), ELK (Elastic Stack — Elasticsearch + Logstash + Kibana, proprietary), OpenSearch (AWS open-source fork). ClickHouse emerging as ultra-fast alternative.

TL;DR

- Log stacks: Loki (cheap), ELK (mature proprietary), OpenSearch (AWS fork).

- ClickHouse emerging alternative.

- Vector / Fluent Bit: collection agents.

- Cost: Loki 5-10× cheaper than Elasticsearch.

Stacks compared

Grafana Loki

• Label-based indexing (not full-text)
• Cheap storage (S3, GCS, MinIO)
• Perfect Grafana integration
• LogQL query language (Prometheus-like)
• Cost: 5-10× cheaper than Elasticsearch same volume

ELK (Elastic Stack)

• Elasticsearch (full-text search)
• Logstash (transform)
• Kibana (visualization)
• License: Elastic 2.0 (non-OSI since 2021)
• Mature, rich features
• Expensive at scale

OpenSearch (AWS fork)

• Open-source Elasticsearch 7.10 fork
• Apache 2.0
• Compatible Elasticsearch queries
• AWS-backed, growing community
• Easy ELK → OpenSearch migration

ClickHouse (logs)

• Columnar OLAP database
• Brutal compression (10-100× ratio)
• Fast massive log queries
• SaaS observability adoption (Signoz, Highlight, BetterStack)

Vector (agent)

• Datadog-acquired (2021)
• Rust, ultra-fast
• Replaces Fluentd, Filebeat
• Forward logs to multiple backends

Fluent Bit / Fluentd

• CNCF graduated
• K8s logs collection standard
• More mature, slower

Compared costs (10 GB logs/day)

• Loki self-host (S3 backend): $50-150/mo
• OpenSearch self-host: $300-700/mo
• ELK self-host: $400-800/mo
• Elastic Cloud: $500-2K/mo
• Datadog Logs: $300-1500/mo
• AWS CloudWatch Logs: $300-600/mo

2026 modern pattern

`

Apps (stdout/stderr structured JSON)

→ Vector / Fluent Bit (collect, transform)

→ Loki / OpenSearch / ClickHouse

→ Grafana / Kibana (query, visualize)

→ Alertmanager / PagerDuty (alerts)

`

Vector example config

`yaml

# vector.yaml

sources:

app_logs:

type: docker_logs

include_labels: ["service=*"]

transforms:

parse_json:

type: remap

inputs: [app_logs]

source: |

. = parse_json!(.message)

sinks:

loki:

type: loki

inputs: [parse_json]

endpoint: http://loki:3100

labels:

service: "{{ service }}"

level: "{{ level }}"

`

LogQL query (Loki)

`

{service="api"} |= "error" | json | duration > 1s

`

Typical Africa startup case

`

DOKS K8s cluster (3 nodes)

→ Vector DaemonSet (collect container logs)

→ Loki (S3-compatible DO Spaces backend)

→ Grafana (visualize + alert)

Cost: ~$100-200/mo

`

FAQ

Q: Loki or ELK?

A: Loki if already Grafana stack + tight budget + label-based queries sufficient. ELK/OpenSearch if complex full-text + larger budget.

Q: Long-term retention?

A: Loki S3 = cheap (object storage). Elasticsearch tier hot/warm/cold + frozen (OpenSearch UltraWarm).

Q: ClickHouse for logs?

A: Emerging, impressive performance. SigNoz/Highlight prove viable. More complex setup than Loki/ELK.

Conclusion

2026 logs management: Loki dominates cost-conscious + Grafana stack. OpenSearch ELK fork for open-source community. ClickHouse emerging ultra-fast. Vector standard collection agent. For Africa startups, Loki + DO Spaces + Vector = economical stack 80% features for 10-20% Datadog cost.