Best / Log management
Best open-source Log management
The best self-hosted log-management split in the c17.io catalog is OpenSearch for an Apache-2.0 search and log cluster (the published Elastic Cloud / Splunk / Papertrail / Loggly stack — current Elasticsearch is SSPL / Elastic License, not the OSI path), Grafana Loki when you want AGPL-3.0 Prometheus-shaped logs — /compare/graylog-vs-loki, Graylog when you want that SSPL-1.0 log box (not OSI), and Dozzle when the job is an MIT realtime container tail rather than a cluster. XERJ is a single-binary Elasticsearch-shaped API for a laptop, not a log fleet. This is not Splunk SPL.
Open the stackStart on Railway
Ranked picks
1
OpenSearchApache-2.0 search and logs — the c17 Elastic Cloud / Splunk / Loggly path.
When to pick it: A log and search cluster you host.
13,905 stars in the catalog
2
Grafana LokiAGPL-3.0 log aggregation (Grafana Loki) — /compare/graylog-vs-loki and /compare/signoz-vs-loki.
When to pick it: Prometheus-shaped logs next to Grafana OSS.
29,055 stars in the catalog
3
GraylogSSPL-1.0 log management, not OSI. /compare/graylog-vs-loki.
When to pick it: A source-available log box if you accept SSPL.
8,164 stars in the catalog
4
DozzleMIT realtime log viewer for Docker, Swarm, and Kubernetes.
When to pick it: Tail containers, not a Splunk cluster.
14,733 stars in the catalog
5
XERJMIT Elasticsearch-shaped API already on /tools/xerj. Not a log fleet.
When to pick it: A laptop or one host, not Loggly ingest.
10,434 stars in the catalog
How they compare
| Tool | License | Self-host | Best for |
|---|---|---|---|
| OpenSearch | Apache License 2.0 | Medium | A log and search cluster you host. |
| Grafana Loki | GNU Affero General Public License v3.0 | Medium | Prometheus-shaped logs next to Grafana OSS. |
| Graylog | SSPL-1.0 | Medium | A source-available log box if you accept SSPL. |
| Dozzle | MIT License | Easy | Tail containers, not a Splunk cluster. |
| XERJ | Apache-2.0 | Easy | A laptop or one host, not Loggly ingest. |
Related pages
- OpenSearch stack
- SigNoz stack
- Grafana OSS + Prometheus stack
- Replace Elastic Cloud
- Replace Splunk
- Replace Papertrail
- Replace Loggly
- Replace New Relic
- Replace Honeycomb
- Replace Dynatrace
- Replace Datadog
- Replace Grafana Cloud
- Graylog vs Grafana Loki
- SigNoz vs Grafana Loki
- All best open-source pages
- All compare pages
- All replace pages
- All stacks
- Tools catalog
FAQ
- OpenSearch or Loki?
- OpenSearch if you want the published Splunk / Loggly cluster. Loki if you want Prometheus-shaped logs next to Grafana — /compare/graylog-vs-loki.
- Loggly, Papertrail, or Splunk?
- Same published log index — /replace/loggly, /replace/papertrail, and /replace/splunk.
- Why not Elasticsearch?
- Recent Elasticsearch is SSPL and Elastic License. OpenSearch is Apache-2.0. That is the stack FAQ.
- Are these free?
- OpenSearch is Apache-2.0. Loki is AGPL-3.0. Dozzle is MIT. Graylog is SSPL-1.0, not OSI. You pay disk and hosting. Template users never pay c17.
- How do I deploy it?
- Open /stacks/opensearch. Persist data. Point one client at the new URL.
Stack of the Week
Get one stack a week that replaces a SaaS bill.