Log management (ELK/OpenSearch)
We set up the collection, processing and search of logs for infrastructure and applications so that so that events are traceable and incidents can be resolved quickly and consistently.
What we typically address
- collection and delivery of logs (agents, pipeline, delivery reliability)
- parsing, normalisation and uniform search fields
- retention and index strategy with regard to costs
- basic detections from logs (alerts) and "saved searches" for triage
Why is it important?
Logs provide a detailed record of system events. Without them, it is difficult to investigate incidents, support security audits or understand why an application fails.
Examples: detecting a security incident (who logged in and when?), debugging an application error (what happened before the crash?) or compliance audit (do we have proof?).
What it involves
- Ingestion: collecting logs from servers, applications and the network
- Indexing: processing and storing data in a consistent format
- Search: finding relevant logs quickly (Elasticsearch, OpenSearch)
- Visualisation: dashboards and alerting on log patterns
- Retention: how long we keep the logs and who has access to them
Typical problems without log management
- Scattered logs: without centralisation, finding important data is slow and unreliable
- Without context: logs exist, but are unreadable or without correlation IDs
- No audit trail: without centralised logs, it is difficult to establish who changed a configuration and when
- Compliance: audit asks where the logs are — and without them it's a problem
Frequently asked questions
How long should we keep logs?
It depends on compliance and purpose. Typically 30 to 90 days online for quick search and 1 to 2 years in archive.
ELK vs OpenSearch vs Splunk?
ELK and OpenSearch are flexible and often more cost-effective. Splunk tends to be more expensive, but powerful in larger enterprise scenarios. The choice depends on the budget and complexity.
How to parse logs without format?
The first step is to establish a clear log format — ideally JSON. Only then does parsing and further structuring make sense.
How we work
Assessment: we'll find out how your log management works — or if it even exists.
Design: architecture, retention, alerting and compliance requirements.
Setup & integration: ELK/OpenSearch deployment, log ingestion, dashboards and alerting.
Contact
If you want to set up a centralised log management or improve an existing one, get in touch with us.