Grafana Loki vs Elasticsearch
Grafana Loki vs Elasticsearch for log management in 2026: label-only indexing on object storage vs full-text inverted indexes, LogQL vs ES|QL and Query DSL, logsdb index mode, data tiers and searchable snapshots, retention, deployment modes and sizing, agents and OpenTelemetry, alerting, multi-tenancy and auth, AGPL vs ELv2/SSPL/AGPL licensing, free vs paid features, and Grafana Cloud vs Elastic Serverless pricing, with a clear pick per situation.
Quick Answer
Loki and Elasticsearch both store and search logs at scale, but they make opposite bets. Grafana Loki (AGPL-3.0) indexes only a small set of labels per log stream and writes compressed chunks to object storage such as S3, GCS or Azure Blob. That keeps the index tiny and storage cheap, but every query must first narrow by labels and then scan matching chunks, so label design and query discipline matter. Queries use LogQL, which feels like PromQL and can turn logs into metrics; the UI is Grafana. Loki has no built-in authentication and keeps logs forever until you enable retention in the compactor. Latest: 3.7.10 (13 November 2026), with 4.0 in release candidates and Simple Scalable mode being removed. Elasticsearch builds an inverted index over log content, so full-text and field searches across everything are fast, and you get Kibana, ES|QL, aggregations, data tiers and lifecycle management. Its free code is available under ELv2, SSPL or AGPLv3 since 2024, but some log-storage savings sit in the paid Enterprise tier: synthetic _source for logsdb indices and searchable snapshots (the frozen tier). Latest: 9.5.6 (2 November 2026) and 8.19.25. Pick Loki for cheap, high-volume Kubernetes logs next to Prometheus and Grafana. Pick Elasticsearch when people search log content ad hoc, need analytics, or run security use cases.
Last updated November 14, 2026. Covers Grafana Loki 3.7.10 and 3.6.21 (13 November 2026) with 4.0.0-rc.3, and Elasticsearch 9.5.6 and 9.4.9 (2 November 2026) with 8.19.25, using grafana.com Loki docs and pricing, elastic.co docs, subscriptions table, pricing, licensing FAQ and EOL policy, and the GitHub API, read in November 2026.
| Feature | Grafana Loki | Elasticsearch |
|---|---|---|
| License | AGPL-3.0 (open source); Grafana Enterprise Logs (GEL) and Grafana Cloud Logs are Grafana Labs' commercial offerings | Free portions available under your choice of ELv2, SSPL 1.0 or AGPLv3 (AGPL added in September 2024); paid features under Elastic's commercial licence |
| Indexing Model | Indexes only labels (key-value metadata per stream) plus timestamps; log line content is not indexed | Inverted index for text, columnar doc values and BKD trees for numbers, dates and geo; every mapped field is searchable; logsdb index mode tuned for logs |
| Storage Backend | Index (TSDB, recommended since 2.8) and compressed chunks both in object storage (S3, GCS, Azure Blob, others) or the filesystem for small setups; BoltDB store deprecated | Local disks on data nodes organised into hot, warm, cold and frozen tiers; snapshots to object storage; frozen tier mounts searchable snapshots from object storage |
| Query Language | LogQL: mandatory stream selector plus a pipeline of line filters, parsers (JSON, logfmt, regex, pattern), label filters and formatting; metric queries with PromQL-style functions | ES|QL (piped query language, free incl. lookup joins and JSON extraction), Query DSL, and KQL or Lucene syntax in Kibana Discover |
| Full-Text Search | Line filters (substring, regex, case-insensitive) evaluated by scanning chunks for the selected streams and time range; no inverted index | Yes: analysed full-text search over indexed text plus fast filtering and aggregations on every indexed field |
| High-Cardinality Fields | Keep out of labels; use structured metadata (schema v13, TSDB) for values like pod names, trace or user IDs; bloom filters for needle-in-haystack queries are experimental | Handled natively as keyword fields; cardinality mainly affects memory and index size rather than query design |
| Metrics from Logs | Yes: LogQL metric queries (rate, count_over_time, quantile over extracted values) and recording rules in the ruler | Aggregations, ES|QL STATS, transforms and downsampling (free); anomaly detection on log rates needs Platinum or Enterprise |
| User Interface | No UI of its own; Grafana (Explore, Logs Drilldown, dashboards) or LogCLI and the HTTP API | Kibana: Discover, dashboards, Observability log views and Streams (Streams AI suggestions are Enterprise) |
| Agents & Ingestion | Grafana Alloy (recommended), OpenTelemetry Collector, and third-party clients via plugins; Promtail reached end of life on 2 March 2026 and was removed in 3.7.3 | Elastic Agent and Fleet, Filebeat and other Beats, Logstash, ingest pipelines; free on Basic |
| OpenTelemetry | Native OTLP over HTTP (otlphttp exporter to /otlp); resource and log attributes stored as structured metadata, enabled by default since 3.0 | Accepts OpenTelemetry data via Elastic's EDOT Collector distribution and Elastic integrations |
| Retention & Lifecycle | Compactor applies global, per-tenant or per-stream retention; disabled by default, so logs live forever until configured; not retroactive | Index lifecycle management and data stream lifecycle (free) roll over, shrink, move between tiers and delete indices on schedule |
| Cheap Long-Term Storage | Everything already lives in object storage; Loki 4.0 RC limits S3 storage classes to STANDARD and STANDARD_IA | Frozen tier holds partially mounted searchable snapshots, up to 20x the capacity of the warm tier per Elastic; searchable snapshots are Enterprise-only |
| Deployment Modes | Monolithic (-target=all, up to about 20 GB/day), HA monolithic, Simple Scalable (about 1 TB/day, deprecated and removed in 4.0) and microservices for the largest Kubernetes deployments | Self-managed (packages, Docker, Kubernetes via ECK), Elastic Cloud Enterprise, Elastic Cloud Hosted and Elastic Cloud Serverless; start-local script for local Docker development only |
| Published Sizing Guidance | Published per-component CPU and memory requests for three tiers: under 100 TB/month, 100 TB to 1 PB/month, and about 1 PB/month (microservices mode) | Heap auto-sized from node roles and memory by default; production guidance per deployment type rather than a per-volume table |
| Multi-Tenancy | Built in and on by default (auth_enabled: true); tenants isolated by the X-Scope-OrgID header; optional multi-tenant queries | No tenant model in the engine; usually separate indices or data streams per tenant secured with role-based access, plus Kibana Spaces (free) |
| Authentication & Access Control | None built in; Grafana's docs require an authenticating reverse proxy (nginx, HAProxy, OAuth2 Proxy); per-user access is otherwise handled in Grafana | Built-in security with TLS and role-based access control on Basic; SSO (SAML, OIDC, Kerberos, JWT), audit logging and field/document-level security on Platinum and Enterprise |
| Alerting | Ruler evaluates LogQL alerting and recording rules and sends to Prometheus Alertmanager or Grafana Alerting; Grafana-managed alerts can also query Loki | Kibana alerting and actions with connectors (Slack, Teams, PagerDuty, webhooks) on Basic; ML anomaly and SLO rule types on Platinum and Enterprise |
| Pattern Analysis & ML | Logs Drilldown in Grafana surfaces patterns and log levels; Adaptive Logs (Grafana Cloud) suggests patterns to drop | Log pattern analysis and machine learning anomaly detection on Platinum and Enterprise; AI-assisted parsing with Streams on Platinum and Enterprise |
| Paid-Only Features | Open-source Loki has no gated features; GEL and Grafana Cloud add commercial support and, for Cloud, managed operations and Adaptive Logs | Enterprise: searchable snapshots, synthetic _source (incl. logsdb), pattern_text, cross-cluster ES|QL; Platinum and Enterprise: ML, log pattern analysis, SSO, audit logs, field/doc security, cross-cluster replication |
| Managed Cloud Pricing | Grafana Cloud Logs: Free 50 GB ingested/month, 14-day retention; Pro from $19/month platform fee incl. 50 GB and 30-day retention, then from $0.050/GB process, $0.400/GB write, $0.100/GB retain; Enterprise from $25,000/year commit | Elastic Observability Serverless Logs Essentials: ingest as low as $0.07/GB, retention as low as $0.017/GB-month; Complete: ingest as low as $0.09/GB, retention $0.019/GB-month; egress 50 GB free then $0.05/GB; Hosted priced by resources |
| Release & Support Policy | Major roughly yearly, minor roughly quarterly, patch once or twice a month; 3.7 and 3.6 both receive patch releases | Each major maintained for the longer of 30 months from GA or 18 months after the next major; maintenance for the two latest minors of the current major plus the last minor of the previous one |
| Latest Release (Nov 2026) | 3.7.10 and 3.6.21 (13 November 2026); 4.0.0-rc.3 (7 November 2026) | 9.5.6 and 9.4.9 (2 November 2026); 8.19.25 (10 November 2026) |
Grafana Loki
Grafana Loki is a horizontally scalable, multi-tenant log aggregation system from Grafana Labs, inspired by Prometheus. Instead of indexing log content, it indexes a small set of labels per stream and stores compressed log chunks in object storage, which makes it cheap to run at high volume. You query it with LogQL, usually from Grafana, and it fits naturally next to Prometheus or Mimir for metrics and Tempo for traces.
Pros
- Only labels are indexed and chunks live in object storage (S3, GCS, Azure Blob), so storage and index costs stay low at high volume
- One binary runs as a single process, HA monolithic or full microservices; Grafana Labs documents scale from a Raspberry Pi to petabytes a day
- LogQL feels like PromQL, adds parsers and line filters, and generates metrics from logs for dashboards and alerts
- Native OTLP ingestion over HTTP, with OpenTelemetry attributes stored as structured metadata
- Built-in multi-tenancy, a ruler for alerting and recording rules, and tight integration with Grafana, Mimir and Tempo
- AGPL-3.0 with no feature tiers in the open-source project; Grafana Cloud Logs has a free tier of 50 GB ingested per month
Cons
- Searching log content means scanning chunks; queries without a narrow label selector or time range get slow and expensive
- High-cardinality values must not become labels; you design labels and structured metadata up front
- No authentication layer of its own: you must put an authenticating reverse proxy in front
- Logs are kept forever until you enable retention in the compactor, and retention changes are not retroactive
- Bloom-filter query acceleration is experimental and aimed at over 75 TB a month; the Helm chart moved to community maintenance in 2026
Best For
Kubernetes and cloud-native teams already on Prometheus and Grafana that ship large log volumes, mostly query by service, namespace or trace ID within a time window, and want object-storage economics.
Elasticsearch
Elasticsearch is the distributed search and analytics engine at the heart of the Elastic Stack, with Kibana for exploration and dashboards and Elastic Agent, Beats and Logstash for ingestion. For logs it builds an inverted index and columnar structures over every field, so full-text search and aggregations across large datasets are fast. Elastic sells it self-managed under subscription tiers, as Elastic Cloud Hosted and as Elastic Cloud Serverless.
Pros
- Full-text and field search over all log content through the inverted index, with no need to pick labels in advance
- Kibana Discover, dashboards and alerting, plus ES|QL (including lookup joins) on the free Basic tier
- logsdb index mode is on by default for new logs-*-* data streams since 9.0; Elastic's benchmarks show up to 60% less storage
- Free data tiers, index lifecycle management, data stream lifecycle and downsampling for retention management
- Mature ingestion: Elastic Agent with Fleet, Beats, Logstash, and Elastic's OpenTelemetry Collector distribution (EDOT)
- Same engine covers search, observability and security (SIEM), so one cluster can serve several teams
Cons
- Indexing everything costs CPU, RAM and fast disk; clusters need capacity planning for shards, heap and storage
- Synthetic _source for logsdb, pattern_text fields and searchable snapshots (needed for the frozen tier) are Enterprise-only
- Machine learning, log pattern analysis, SSO, audit logging and field/document-level security need Platinum or Enterprise
- Self-managed paid tiers are quote-only, priced by nodes and RAM, and Platinum is no longer sold to new self-managed customers
- Licence choice (ELv2, SSPL or AGPLv3) needs a legal read if you redistribute or offer it as a service
Best For
Teams that search log content ad hoc across many services, need aggregations and analytics over log fields, run security or compliance investigations, or already use the Elastic Stack for search.
Index labels vs index everything
The whole comparison follows from one design decision. Loki does not index the content of log lines. It groups logs into streams identified by labels such as namespace, app or cluster, indexes only those labels and timestamps, and writes the lines as compressed chunks to object storage. A query must start with a stream selector, then Loki fetches and decompresses the matching chunks and scans them with line filters and parsers. This keeps ingestion cheap and the index small, which is why Grafana Labs pitches Loki as scaling from a Raspberry Pi to petabytes a day. The cost moves to query time: a broad selector over a long range means scanning a lot of data, and putting high-cardinality values such as user IDs or pod names into labels creates too many streams and hurts performance. Loki's answer is structured metadata, which attaches such values to log lines without indexing them, and experimental bloom filters for needle-in-haystack queries, aimed at installations ingesting over 75 TB a month. Elasticsearch does the opposite: it parses each log event into fields and builds an inverted index and columnar doc values for them. Searching for an arbitrary string or filtering on any field across all services is fast, and aggregations over fields are a core strength. The price is paid at write time in CPU, memory and fast disk.
What it really costs to store a terabyte
On self-managed infrastructure Loki is usually the cheaper store, because its bulk data sits in object storage at object-storage prices and its index stays small. Elasticsearch keeps hot data on local disks on data nodes, replicated, and needs RAM for heap and file system cache. Elastic has narrowed the gap. Since 9.0, new logs-*-* data streams default to logsdb index mode, which Elastic's benchmarks say cuts storage by up to 60% with a 10 to 20% indexing cost; the exact gain depends on your data. Two caveats matter for budgeting. Elastic's subscription table lists synthetic _source for logsdb indices, and the pattern_text field type, as Enterprise features, so the free Basic tier gets logsdb mode without them. And the frozen tier, which mounts searchable snapshots from object storage and holds up to 20 times more data than the warm tier, requires searchable snapshots, also Enterprise-only. On managed services, Grafana Cloud Logs gives 50 GB a month free with 14-day retention; Pro costs a $19 monthly platform fee including 50 GB and 30-day retention, then starts at $0.050 per GB processed, $0.400 per GB written and $0.100 per GB retained, and Adaptive Logs suggests patterns to drop before they are written. Elastic Observability Serverless Logs Essentials starts as low as $0.07 per GB ingested and $0.017 per GB-month retained, with Complete at $0.09 and $0.019. Both use volume tiers, so model your own numbers.
Querying and day-to-day use
LogQL will feel familiar to anyone who writes PromQL. A query is a stream selector like {service_name="nginx"} followed by a pipeline of line filters, parsers for JSON, logfmt or regex, label filters and formatting. Metric queries such as rate or count_over_time turn logs into time series for dashboards and alerts, and the ruler can store those as recording rules. Loki has no UI of its own: you work in Grafana's Explore, Logs Drilldown, which surfaces patterns and levels without writing queries, and dashboards, or with LogCLI. That suits teams living in Grafana; it is less friendly for people who just want to type a word into a search box. Elasticsearch gives you Kibana Discover for free-form search with KQL, field-level filtering and histograms, dashboards, plus ES|QL, a piped query language with aggregations, lookup joins and JSON extraction, all on the free Basic tier. Kibana alerting with Slack, Teams, PagerDuty and webhook connectors is free too. Where the tiers bite is analysis: log pattern analysis and machine learning anomaly detection need Platinum or Enterprise, and Streams' AI suggestions are Enterprise. If your users are developers who already know which service they are debugging, LogQL in Grafana works well. If your users include support, security or analysts exploring unknown problems, Kibana and full-text search are hard to beat.
Operating each one: modes, sizing, security and upgrades
Loki ships as one binary that can run every component in a single process (Grafana Labs suggests up to about 20 GB a day), as HA monolithic with shared object storage, or as microservices on Kubernetes with per-component scaling. Simple Scalable mode, long the Helm chart default and good to about 1 TB a day, is deprecated and will not run on Loki 4.0, which is in release candidates now; the Helm chart itself moved to the grafana-community repository on 16 March 2026. Grafana publishes sizing tables for under 100 TB, 100 TB to 1 PB and about 1 PB per month. Two defaults catch people: Loki has no authentication layer, so you need an authenticating reverse proxy, and retention is off, so logs stay forever until you enable it in the compactor. Promtail is end of life, so new installs should ship with Grafana Alloy or the OpenTelemetry Collector. Elasticsearch needs more capacity planning for shards, replicas, heap and tiers, though heap is auto-sized by default and ECK, Elastic Cloud Enterprise and Elastic Cloud take on much of the work. Security with TLS and role-based access is free; SSO, audit logging and field- or document-level security need Platinum or Enterprise. Elastic maintains each major for at least 30 months, and supports the two newest minors plus the last minor of the previous major: today 9.5, 9.4 and 8.19.
Licensing, lock-in and migration
Loki is AGPL-3.0, the same licence Grafana Labs uses for Grafana, and the open-source project has no paid feature gates; Grafana Enterprise Logs and Grafana Cloud add commercial support and managed options. For most teams running Loki internally, the AGPL's network clause matters mainly if you modify Loki and offer it to others as a service. Elasticsearch's free code has been available under ELv2 and SSPL since 2021, and Elastic added AGPLv3 as a third option in September 2024, so you can now pick an OSI-approved licence. Paid features are not open source under any of the three, and that is where the real decision lies: self-managed Enterprise and the remaining Platinum customers are priced by nodes and RAM through sales, and Platinum is no longer sold to new self-managed customers. Migration between the two is mostly about ingestion and queries rather than stored data. Both accept OpenTelemetry, so standardising on an OpenTelemetry Collector or Grafana Alloy pipeline keeps your options open; Loki takes OTLP natively over HTTP and Elastic offers its EDOT Collector distribution. Saved Kibana searches, dashboards and alert rules have to be rewritten in LogQL and Grafana, or the reverse. Teams commonly run both for a while: Loki for high-volume application and Kubernetes logs, Elasticsearch for security data and audit logs that need full-text search.
Verdict
Pick Grafana Loki when logs are high volume, mostly machine-generated, and usually queried by where they came from: a namespace, service, pod or trace ID within a time window. If you already run Prometheus and Grafana, Loki slots in with the same label model, LogQL that reads like PromQL, and object storage that keeps the bill low, and the open-source build has no paid feature gates. Budget the work it moves onto you: design low-cardinality labels, put an authenticating proxy in front, turn on retention in the compactor, and plan your move off Simple Scalable mode before Loki 4.0. Pick Elasticsearch when people search log content they cannot predict, like an error string across every service for the last month, when you need aggregations and analytics over log fields, or when security and compliance teams investigate logs. Kibana, ES|QL, lifecycle management and logsdb mode are free, but read the subscription table before sizing: synthetic _source for logsdb and searchable snapshots for a frozen tier are Enterprise features, and ML and log pattern analysis need Platinum or Enterprise. On a self-managed free tier, Elasticsearch costs more hardware per GB than Loki; on managed services, compare Grafana Cloud's process, write and retain rates with Elastic Serverless's ingest and retention rates against your real volume.