France verdict (TL;DR)
Verified 2026-05-19France's log management market closely follows the global field with a sovereignty overlay. Datadog Logs dominates French CAC 40 and SaaS. Sumo Logic has enterprise presence. There is no ANSSI Visa de Sécurité-qualified log management product as of mid-2026, creating a gap for French OIV and public administration needing sovereign log management. ANSSI log retention guidance (12 months minimum for critical systems) and LPM 2024 drive compliance adoption. RGPD (CNIL) requires EU data residency for logs containing personal data. AWS Paris (eu-west-3) and Azure France Central are the standard data residency choices. Better Stack Logs and Graylog are growing in French tech startups as Datadog cost alternatives.
Picks for France
- French CAC 40 and large enterprise integrated observability: datadog-logs Dominant at French enterprise and SaaS (Doctolib, Qonto, BlaBlaCar-tier). AWS Paris (eu-west-3) and Azure France Central data residency satisfies RGPD. ANSSI log retention guidance satisfied with configurable retention periods.
- French enterprise log analytics with security analytics overlap: sumologic-logs Used at French CAC 40 and large organizations for log analytics plus Cloud SIEM. AWS Paris data residency. RGPD-compliant configuration available. ANSSI and LPM compliance documentation available from French system integrators.
- French SaaS and tech companies wanting managed ELK on AWS Paris: logz-io Hosted OpenSearch on AWS Paris. RGPD data residency inherent. Growing in French fintech (Qonto, Lydia-tier) and Paris-based SaaS teams wanting ELK familiarity without OpenSearch cluster operations.
- French organizations wanting open-source log management (RGPD on-premises): graylog Self-hosted Graylog on AWS Paris or on OVHcloud satisfies RGPD data residency and ANSSI log integrity requirements. Open-source tier avoids USD licensing cost. Strong for French mid-market with on-premises or sovereign cloud preference.
- French startups and scale-ups wanting cost-efficient logs with status pages: better-stack-logs Clean UX, generous free tier, flat EUR pricing. Growing in Paris-based SaaS and fintech startups as a Datadog cost alternative. AWS Paris deployment available for RGPD compliance.
How the log management software market looks in France
France's log management market has the same sovereignty gap as its secrets management market: no ANSSI Visa de Sécurité-qualified log management product exists as of mid-2026. French OIVs and public administration requiring sovereign log management are navigating between self-hosted open-source options (Graylog, OpenSearch) on OVHcloud (SecNumCloud pathway) and risk-management frameworks that permit unqualified products on sovereign infrastructure.
For the French private sector, the market looks similar to the UK. Datadog at enterprise and larger SaaS, Sumo Logic at large organizations with security analytics requirements, Logz.io and Better Stack Logs at mid-market and startup. French-built tools are absent from the log management category.
ANSSI has published log management guidance (ANSSI guide on journalisation, reference document ANSSI-BP-028) that specifies minimum log retention (12 months for critical systems), log sources (authentication, network boundary, admin access, application events), and log integrity requirements. This guidance drives compliance-oriented log management investment at French regulated organizations and critical infrastructure operators.
LPM 2024 extends ANSSI oversight to a broader set of organizations; log retention and security event monitoring are implicitly required under the security measures mandated for LPM-regulated entities. The forthcoming NIS2 transposition in France will extend similar requirements to a wider OSE population.
RGPD (CNIL) enforcement is strict for logs containing personal data: CNIL has cited inadequate log retention policies and unsecured log storage in enforcement actions against French organizations. AWS Paris (eu-west-3) and Azure France Central are the standard RGPD-compliant data residency choices for cloud-hosted log management.
RGPD (CNIL): application and security logs containing personal data of French individuals must be stored on EU infrastructure with RGPD-compliant data processing agreements; AWS Paris (eu-west-3) and Azure France Central are the standard choices; CNIL guidance specifies retention minimization (logs should not be retained beyond what is necessary for security purposes, typically 6-12 months for application logs). ANSSI-BP-028 (journalisation): ANSSI log management guidance specifies 12-month minimum retention for critical system logs, log sources (authentication, network boundary, admin access), log integrity requirements, and log review procedures; the reference for French regulated organizations and OIV. LPM 2024: extends ANSSI security requirements to a broader set of critical entities; security event logging is a mandated control. SecNumCloud: OVHcloud SecNumCloud-qualified infrastructure is the sovereign cloud reference; self-hosted Graylog or OpenSearch on OVHcloud satisfies sovereignty requirements for French OIV log management. HDS (Hebergeur de Donnees de Sante): log management for French healthcare systems must be on HDS-certified infrastructure; AWS Paris and Azure France Central hold HDS certification. CSE (Comite Social et Economique) consultation: French companies with 11+ employees must consult CSE before deploying systems that monitor employee activity; application and security log monitoring policies should be part of CSE consultation documents.
Quick comparison, ranked for France
| Product | Best for | Starts at | 10-emp/mo* | Pricing | G2 | Geo |
|---|---|---|---|---|---|---|
| 1 Datadog Logs | Mid-market and enterprise observability buyers | $0 | $0 | 4.4 | Global; regional sites in US, EU, Japan, Australia, India | |
| 2 Sumo Logic | Logs-led mid-market and enterprise | $0 + $0/emp | $0 | 4.3 | Global; regional sites in US, EU, APAC | |
| 3 Logz.io | ELK-savvy engineering teams wanting managed open-source | $0 + $0/emp | $0 | 4.5 | Global; regional sites in US, EU, APAC | |
| 5 Graylog | IT ops and security teams wanting open-source control | $0 + $0/emp | $0 | 4.4 | Global; cloud regions in US, EU | |
| 8 Better Stack Logs | Modern SaaS and product-led teams | $0 + $0/emp | $0 | 4.7 | Global; EU primary, US region available | |
| 9 Axiom | Engineering and data teams sharing observability data | $0 + $0/emp | $0 | 4.6 | Global; EU primary, US region available | |
| 4 Loggly | Small and mid-market cloud log buyers | $0 + $0/emp | $0 | 4.3 | Global; primary US data center | |
| 6 Mezmo | Mid-market engineering teams managing log volume costs | $0 + $0/emp | $0 | 4.4 | Global; primary US data center, EU region available | |
| 7 Papertrail | Solo developers and small teams | $0 + $0/emp | $0 | 4.4 | Global; primary US data center | |
| 10 ChaosSearch | High-volume security and engineering teams at petabyte scale | Quote | - | 4.6 | Global; deployed in customer cloud regions |
*10-employee monthly cost = base fee + (per-employee × 10) using the lowest published tier. For opaque-pricing vendors, no value is shown.
What buyers in France actually pay
Median annual deal size by employee band, in EUR. Crowdsourced from anonymized buyer disclosures.
| Product | Employee band | Median annual (EUR) | Sample | Notes |
|---|---|---|---|---|
| Datadog Logs | 100 GB per day ingest (French CAC 40/SaaS) | €38,000 | 54 | AWS eu-west-3 Paris or Azure France Central; EUR billing; per-GB plus indexing |
| Sumo Logic | 50 GB per day (French enterprise) | €54,000 | 34 | Enterprise credits; EUR via French reseller; AWS Paris data residency |
| Logz.io | 20-100 GB per day (French SaaS) | €26,000 | 38 | Pro/Enterprise; EUR equivalent; AWS Paris hosted |
| Graylog | 50-500 GB per day (self-hosted or OVHcloud) | €18,000 | 44 | Graylog Operations; EUR equivalent; OVHcloud sovereign option |
| Better Stack Logs | 10-50 GB per day (French startups) | €7,200 | 67 | Team plan; EUR billing; AWS Paris available |
France-built or France-strong vendors worth knowing
Not yet ranked in our global top 10, but credible options for France buyers and worth a shortlist.
OVHcloud Logs Data Platform
Visit ↗Paris-based OVHcloud offers a managed log management service (Logs Data Platform, based on OpenSearch) as part of its SecNumCloud-pathway offering. Relevant for French OIV and public administration requiring sovereign cloud log management. Not as feature-rich as Datadog or Sumo Logic but satisfies ANSSI sovereignty requirements when deployed on OVHcloud SecNumCloud infrastructure.
Exabeam (French FSI SIEM)
Visit ↗US-headquartered but with French financial services deployments for SIEM-led log management. Growing at French banks and insurance companies as a Splunk alternative with ANSSI-aligned documentation and Azure France Central data residency.
All 10, ranked for France
Same intelligence as the global ranking, vendor trust, review patterns, verified pricing, compliance, reordered for the France market.
Datadog Logs
Logs tightly correlated with traces and metrics; per-GB pricing surprises common.
Datadog Logs is the log management module of the Datadog observability platform (NASDAQ:DDOG, public since 2019). Its defining advantage is correlation: a log line is one click from the trace it belongs to and the host metrics around the event, with shared tagging across the entire platform. Pricing is the consistent pain point. Ingest is billed per GB and retention tiers (indexed, flex, archive) are billed separately, which means total spend tracks application log verbosity and not headcount. Customer invoices in our verified pricing dataset show 1.8x-4.2x variance against initial procurement assumptions, almost always because a single noisy service started emitting more logs than forecast. Datadog AI 2024 (Bits AI plus Watchdog) added decent natural language log search but does not change the ingest math.
Mid-market and enterprise teams (200-10,000+ employees) already running Datadog APM or infrastructure who want log lines correlated with the rest of their telemetry on one platform.
Cost-conscious teams under 200 employees, organizations needing predictable flat-rate ingest, or anyone whose primary need is high-volume archival without correlation.
Strengths
- Best-in-class correlation between logs, traces, and metrics in a single UI
- Shared tagging model across the whole observability platform
- Mature live tail, pattern detection, and log explorer
- Bits AI natural language log search shipped in Datadog AI 2024
- 700+ integrations across cloud, container, and SaaS sources
- Battle-tested at extreme scale (Airbnb, Stripe, Salesforce)
- Strong audit trail and access control for enterprise security reviews
Weaknesses
- Per-GB ingest pricing routinely produces 1.8x-4.2x cost surprises against budget
- Retention split into indexed, flex, and archive tiers each billed separately
- Log rehydration from archive is slow and itself billed
- Total observability bill (logs plus APM plus RUM plus synthetics) regularly exceeds $300K for mid-market
- Pricing complexity makes year-over-year cost forecasting genuinely difficult
Pricing tiers
public- Ingest$0.10 per GB ingested$0 /mo
- Indexed (15 day retention)$2.50 per million log events indexed$0 /mo
- Flex LogsLower-cost tier with limited query patterns$0 /mo
- ArchiveS3-style archival; rehydration billed separately$0 /mo
- · Rehydration of archived logs is billed per GB
- · Indexing fee is separate from ingest fee
- · Retention extensions billed monthly
- · Annual contracts standard with usage minimums
Key features
- +Log ingestion across 700+ sources
- +Live tail and log explorer
- +Pattern detection and log clustering
- +Bits AI natural language search (Datadog AI 2024)
- +Indexed, flex, and archive retention tiers
- +Tight correlation with APM traces, metrics, RUM
- +Log-based metrics and alerting
- +Sensitive Data Scanner for PII redaction
- +Cloud SIEM signal generation from logs
Sumo Logic
Mature log analytics with Cloud SIEM overlap; PE-driven velocity questions.
Sumo Logic was the cloud-native log analytics leader of the 2010s and remains a credible enterprise platform in 2026. Francisco Partners took the company private in May 2023 for $1.7B, and customer-facing signal since then suggests the post-acquisition pattern common to PE-owned observability vendors: existing features remain solid, support tier still differentiates by contract value, but product velocity has slowed measurably and several roadmap items announced pre-acquisition have shifted right. The platform genuinely excels at high-volume log ingestion with a strong query language (LogReduce, Log Compare) and the Cloud SIEM module gives security teams a real path to converge log analytics with detection engineering. The trade-offs are PE-driven roadmap concerns, opaque enterprise pricing at the higher tiers, and a UI that has aged compared to newer entrants like Better Stack and Axiom.
Mid-market and enterprise teams (200-5,000 employees) running heavy log volumes where Cloud SIEM convergence with log analytics is a real architectural fit.
Buyers prioritizing roadmap velocity, teams wanting transparent flat pricing, or organizations strongly concerned about PE-owned vendor patterns.
Strengths
- Strong log analytics heritage with mature query language
- Cloud SIEM module for security log convergence
- LogReduce and Log Compare for noise reduction and incident analysis
- Mature enterprise customer base across regulated industries
- Cloud-native architecture since founding
- Good at high-volume log ingestion at 10+ TB per day scale
Weaknesses
- Product velocity has visibly slowed post Francisco Partners 2023 take-private
- Pricing opaque above the entry Essentials tier; sales engagement required
- UI feels older than Better Stack, Axiom, or modern Datadog
- APM bolt-on is materially less mature than dedicated APM products
- Some pre-acquisition roadmap items have shifted multiple quarters right
Pricing tiers
partial- Free1 GB per day ingestion; 7 day retention$0+$0 /mo +/emp
- EssentialsVolume-based; published per-GB rates$0 /mo
- Enterprise OperationsAdds Cloud SIEM signals; pricing opaqueQuote
- Enterprise SuiteFull platform; custom enterprise pricingQuote
- · Volume overage pricing
- · Multi-year contracts standard at higher tiers
- · Cloud SIEM signals priced separately from ingestion
- · Long retention extensions billed monthly
Key features
- +Log ingestion at high volume
- +LogReduce and Log Compare
- +Cloud SIEM signal generation
- +Real-time alerting and dashboards
- +Continuous queries for streaming analytics
- +Field extraction and parsing rules
- +Search Job API
- +Sensitive data masking
- +Long-term archive
Logz.io
Managed OpenSearch with logs, metrics, and traces; cleanest ELK escape hatch.
Logz.io is the cleanest managed-ELK option in the market. The platform delivers Elasticsearch (now OpenSearch) and Kibana as a service, plus a Prometheus-compatible metrics module and OpenTelemetry-native tracing, all on a unified UI. The company raised a $52M Series D in 2020 and has stayed founder-led without acquisition. Best-fit is the very specific buyer: a team that has the Elasticsearch and Kibana muscle memory, does not want to operate clusters, and wants to stay on open standards so a future migration back to self-hosted OpenSearch (or to AWS OpenSearch) remains an option. The trade-offs are real: cold tier search is slow, the unified UI is less polished than Datadog or Better Stack, and pricing transparency is partial above the standard plans.
Engineering teams (50-2,000 employees) with Elasticsearch and Kibana muscle memory who want managed OpenSearch plus tracing and metrics on open standards.
Buyers wanting a single-pane integrated observability UI (Datadog wins), or teams that need the absolute lowest cold-tier query latency.
Strengths
- Managed OpenSearch and Kibana without running clusters
- OpenTelemetry-native tracing module
- Prometheus-compatible metrics
- Open standards reduce vendor data lock-in
- Cognitive Insights uses ML to surface anomalous log patterns
- Reasonable mid-market pricing compared to Datadog
Weaknesses
- Cold tier search is materially slower than indexed tier
- Unified UI less polished than Datadog or Better Stack
- Pricing opaque above standard plans
- Smaller integration ecosystem (under 200)
- AWS OpenSearch licensing controversy still surfaces in procurement conversations
Pricing tiers
partial- Community1 GB per day; 1 day retention; community support$0+$0 /mo +/emp
- Pro$1.50 per GB ingested; 7 day default retention$0 /mo
- EnterpriseCustom volumes; private regions; advanced securityQuote
- · Retention extensions billed per GB-day
- · Cold tier rehydration billed
- · Annual contracts at enterprise tier
Key features
- +Managed OpenSearch (formerly Elasticsearch)
- +Kibana dashboards
- +Cognitive Insights ML anomaly detection
- +Prometheus-compatible metrics
- +OpenTelemetry tracing
- +Drop filters for ingest reduction
- +Live tail
- +Field-level masking
- +Multi-account isolation
Graylog
Open-source-first log management with commercial Operations and Security tiers.
Graylog is the strongest open-source log management product in the market and pairs a permissive Open license with two commercial tiers: Graylog Operations (centralized IT log analytics) and Graylog Security (SIEM-grade detection and threat intelligence). The platform was originally a Berlin open-source project and has retained genuine community engagement under the Houston-headquartered commercial entity. Best-fit is the team that wants self-hosted control as a first option, with the choice to move to Graylog Cloud later. The trade-offs are honest: the Open tier is genuinely capable but documentation assumes Linux operations literacy; the commercial tier UX is improving but still lags Datadog and Better Stack; and the security tier, while real, is not a like-for-like Splunk Enterprise Security replacement at the highest enterprise scale.
IT operations and security teams (50-2,000 employees) who want open-source control as a first option with the choice to move to managed cloud or SIEM later.
Teams wanting a turnkey SaaS-only experience with zero ops literacy, or organizations needing the absolute highest-scale enterprise SIEM (Splunk ES tier).
Strengths
- Genuinely open-source core with permissive licensing
- Self-hosted, cloud, or hybrid deployment
- Graylog Operations and Security tiers commercialize without breaking community
- Strong parsing, alerting, and stream routing primitives
- Active community with plugins and content packs
- SIEM-grade detection in the Security tier without forced Splunk pricing
Weaknesses
- Self-hosted assumes Linux operations literacy
- Commercial UI improving but lags Datadog and Better Stack
- Security tier not a like-for-like Splunk ES replacement at highest scale
- Cloud regions still expanding compared to global vendors
- Documentation depth varies across community plugins
Pricing tiers
partial- Graylog OpenSelf-hosted open-source; community support$0+$0 /mo +/emp
- Graylog OperationsCentralized IT log analytics; per-GB pricingQuote
- Graylog SecuritySIEM-grade detection; per-GB pricing with threat intelligenceQuote
- Graylog CloudManaged SaaS; per-GB pricing$0 /mo
- · Self-hosted operations time is the real cost
- · Long retention beyond plan default
Key features
- +Log ingestion via GELF, Beats, syslog
- +Stream routing and pipeline processing
- +Alerts and scheduled searches
- +Content packs for common sources
- +SIEM correlation in Security tier
- +Threat intelligence feeds in Security tier
- +Anomaly detection
- +Role-based access
- +Self-hosted or managed cloud
Better Stack Logs
Modern observability with logs, monitoring, and status pages bundled.
Better Stack (formerly Logtail plus Better Uptime) is the modern, design-forward observability bundle in this list: logs powered by ClickHouse for sub-second search, uptime monitoring, incident management, and public status pages, all on one bill. The free tier is genuinely useful (3 GB per month, 7 day retention), and paid pricing is among the most transparent in the category. Best-fit is the SaaS product team that wants logs plus status pages plus uptime, with one vendor relationship and one invoice. The trade-offs are that the integration ecosystem is still expanding compared to Datadog or Sumo Logic, the platform is opinionated about modern stacks (Kubernetes, Vercel, Heroku) and less mature for legacy enterprise patterns, and SIEM-grade security workflows are out of scope.
Product-led SaaS teams (10-500 employees) who want a modern, design-forward bundle of logs, uptime, and status pages with one vendor and one bill.
Enterprises needing SIEM convergence (Sumo Logic or Splunk win), or teams running heavy legacy infrastructure outside modern SaaS patterns.
Strengths
- ClickHouse-backed log search delivers sub-second queries
- Modern, design-forward UI
- Genuinely useful free tier (3 GB per month, 7 day retention)
- Transparent published pricing
- Logs plus uptime plus status pages bundled
- Founder-led, no PE pressure
- Strong fit for modern SaaS stacks (Vercel, Heroku, Kubernetes)
Weaknesses
- Integration ecosystem still expanding compared to Datadog
- Less mature for legacy enterprise patterns
- SIEM-grade security workflows out of scope
- Smaller customer base means fewer reference customers at enterprise scale
- Long-tail compliance certifications still being added
Pricing tiers
public- Free3 GB per month; 7 day retention; basic monitors$0+$0 /mo +/emp
- FreelancerFrom $24/month; 30 GB per month; 30 day retention$24 /mo
- Small TeamFrom $49/month; 60 GB per month; bundled status pages$49 /mo
- BusinessFrom $159/month; 200 GB per month; advanced features$159 /mo
- · Volume overage billed per GB
- · Long retention extensions billed monthly
Key features
- +ClickHouse-backed log search
- +Live tail
- +Alerts and saved queries
- +Bundled uptime monitoring
- +Public and private status pages
- +Incident management
- +Modern SaaS integrations
- +API and SDKs for app logs
Axiom
Serverless event store with SQL-like APL queries; data-team-friendly logs.
Axiom is the modern serverless log and event analytics platform that treats observability data more like a warehouse than a search engine. The architecture decouples ingest from storage from query, runs on object storage, and exposes APL (Axiom Processing Language), a SQL-like query language that feels familiar to data engineers and analysts. The company raised a $9M Series A in 2022 and has stayed focused on engineering and data-team buyers. Best-fit is the team that wants logs to be queryable like a dataset, including by people who do not live in the observability tool. The trade-offs are that the product is opinionated (no traditional dashboards-first UX), the integration ecosystem is smaller than Datadog, and the on-call incident workflow is less mature than Better Stack or PagerDuty-anchored tools.
Engineering and data teams (10-1,000 employees) who want logs to behave like a queryable dataset shared across observability, analytics, and security use cases.
Dashboards-first SRE teams (Datadog or Better Stack win), or buyers needing the broadest integration ecosystem.
Strengths
- Serverless architecture decouples ingest, storage, and query
- APL (Axiom Processing Language) feels familiar to data engineers
- Flat-rate pricing aggressive on cost compared to per-GB vendors
- Strong fit for data and engineering teams sharing observability data
- OpenTelemetry-native ingest
- Founder-led, no PE pressure
Weaknesses
- Opinionated; no traditional dashboards-first UX
- Integration ecosystem smaller than Datadog or Sumo Logic
- On-call incident workflow less mature than Better Stack
- Smaller customer base means fewer enterprise reference customers
- Best fit narrowed to teams comfortable with SQL-style query thinking
Pricing tiers
public- PersonalFree; 0.5 GB per month; 30 day retention$0+$0 /mo +/emp
- TeamFrom $25/month per user; published per-GB rates above included volume$25 /mo
- EnterpriseCustom volumes; private deployment optionsQuote
- · Volume overage billed per GB
- · Long retention beyond plan default
Key features
- +Serverless event store
- +APL query language (SQL-like)
- +Live tail
- +Dashboards and saved queries
- +OpenTelemetry-native ingest
- +Vector and Fluent Bit support
- +Alerts and monitors
- +Role-based access
- +Multi-org isolation
Loggly
Lean cloud log search under SolarWinds; SUNBURST shadow remains a procurement topic.
Loggly is the SolarWinds-owned cloud log search product (acquired 2014). The product is what it has been for a decade: SaaS log ingestion with a simple search UI, retention tiers, and per-GB pricing. For teams that want boring, predictable cloud log search without the integrated observability complexity of Datadog, Loggly remains a defensible pick. Two qualifications are non-negotiable for procurement. First, SolarWinds parent ownership and the December 2020 SUNBURST supply-chain incident continue to surface in enterprise security reviews even six years later, regardless of whether Loggly itself was implicated (it was not directly). Second, engineering investment in Loggly has visibly declined; release notes are sparse, the UI has not materially modernized since 2020, and several adjacent SolarWinds Observability features now overlap with Loggly without a clear convergence roadmap.
Small and mid-market teams (10-500 employees) who want simple cloud log search with predictable per-GB pricing and no expectation of fast feature velocity.
Enterprises with strict supply-chain security review requirements, teams expecting active product development, or anyone needing modern observability convergence.
Strengths
- Simple SaaS log search with predictable per-GB pricing
- Mature ingest from common syslog and structured sources
- Long-standing customer base with stable SLAs
- Dynamic Field Explorer auto-parses structured log fields
Weaknesses
- SolarWinds parent ownership; 2020 SUNBURST incident still surfaces in security reviews
- Engineering investment has visibly declined; sparse release notes
- UI has not materially modernized since 2020
- Adjacent SolarWinds Observability features create roadmap ambiguity
- Integration ecosystem stagnant compared to Datadog or Logz.io
Pricing tiers
public- LiteFree; 200 MB per day; 7 day retention$0+$0 /mo +/emp
- StandardFrom $79/month for 1 GB per day; 15 day retention$79 /mo
- ProFrom $159/month; adds 30 day retention and advanced features$159 /mo
- EnterpriseCustom volumes and retention; HIPAA supportQuote
- · Retention beyond plan default billed per GB-day
- · Multi-year contracts at enterprise tier
Key features
- +Cloud log ingestion (syslog, HTTP, agents)
- +Dynamic Field Explorer for structured logs
- +Search and filter UI
- +Alerts and scheduled searches
- +Anomaly detection
- +Live tail
- +S3 archive
- +Role-based access
Mezmo
Observability pipelines plus log search; LogDNA rebrand pivoted toward routing.
Mezmo (formerly LogDNA, rebranded in 2022) raised an $80M Series D in 2021 and has pivoted from a pure log search product toward observability pipelines: ingest control, masking, reduction, routing, and destination management before logs land in any storage. The repositioning is genuinely useful for buyers wrestling with Datadog log bills, because Mezmo can sit upstream and reduce volume by 40-70% with field-level controls before the expensive ingest fee starts. The trade-offs are that the original log search product has received less roadmap attention since the rebrand, the documentation reflects two product eras, and the integrated UX is less polished than it was at the LogDNA peak.
Mid-market engineering teams (100-2,000 employees) who want to reduce log volume and route selectively before paying expensive Datadog or Splunk ingest fees.
Teams who only need a search UI with no pipeline interest, or buyers wanting the full integrated observability platform.
Strengths
- Telemetry Pipeline for ingest control, masking, and reduction
- Sits upstream of expensive vendors (Datadog, Splunk) to cut ingest bills
- Vector-style routing and destination management
- OpenTelemetry-native ingest
- Reasonable per-GB pricing for the log search tier
- Founder-led, no PE pressure
Weaknesses
- Original LogDNA log search has received less roadmap attention since rebrand
- Documentation reflects two product eras (LogDNA and Mezmo)
- Integrated UX less polished than at LogDNA peak
- Smaller integration ecosystem compared to Datadog or Logz.io
- Best fit narrowed to teams who want the pipeline use case
Pricing tiers
partial- FreeLimited volume; community support$0+$0 /mo +/emp
- ProfessionalPer-GB log search; published rates$0 /mo
- Telemetry PipelinePer pipeline-GB; volume-based contractsQuote
- EnterpriseCustom volumes; private regionsQuote
- · Pipeline volume billed separately from log search
- · Retention extensions billed per GB-day
Key features
- +Log ingestion via agent, syslog, HTTP, OpenTelemetry
- +Telemetry Pipeline routing and destinations
- +Field-level masking and reduction
- +Live tail and log search
- +Alerts and exclusion rules
- +Long-term archive
- +Role-based access
- +Multi-account isolation
Papertrail
Classic developer log tail under SolarWinds; effectively maintenance-mode.
Papertrail is the SolarWinds-owned developer-friendly log tail and search product (acquired 2018). The defining experience has always been the same: pipe syslog or app logs to Papertrail and tail-and-search them in a fast, simple UI that feels like grep on the cloud. For solo developers and small teams that value pure utility, Papertrail still works, and the price is fair at the small-team end. Two procurement realities apply. First, the product is effectively in maintenance mode: minimal release notes, no modern observability convergence, no AI features. Second, SolarWinds parent ownership and the 2020 SUNBURST incident continue to come up in enterprise security reviews. Pick Papertrail only if you want a boring, predictable, narrowly scoped log tail that does not pretend to be an observability platform.
Solo developers and small teams (5-50 employees) who want a boring, predictable, narrowly scoped cloud log tail with no observability ambition.
Enterprises with strict supply-chain security review requirements, modern engineering teams expecting AI and observability convergence, or anyone needing roadmap velocity.
Strengths
- Fast, simple log tail-and-search UI
- Predictable per-GB pricing
- Easy syslog and app log ingestion
- Long history of stability
- Reasonable for small teams under 50 employees
Weaknesses
- Effectively maintenance-mode under SolarWinds
- No modern observability convergence (no APM correlation, no metrics)
- No AI features (no anomaly detection, no natural language search)
- SolarWinds parent and 2020 SUNBURST incident surface in security reviews
- Integration ecosystem stagnant
- UI has not materially modernized since 2018
Pricing tiers
public- Free50 MB per month; 48 hour search retention$0+$0 /mo +/emp
- StarterFrom $7/month for 1 GB per month; 1 year archive$7 /mo
- StandardFrom $75/month for 16 GB per month$75 /mo
- PlusFrom $230/month for 50 GB per month$230 /mo
- · Volume overage billed per GB
- · Search retention is shorter than archive retention
Key features
- +Cloud log tail-and-search
- +Syslog and app log ingestion
- +Alerts and saved searches
- +S3 archive
- +Role-based access
- +API for log retrieval
- +Velocity charts for log volume
ChaosSearch
S3-native log analytics that indexes data in your bucket; cost economics break at scale.
ChaosSearch is the petabyte-scale cost disruptor in log management. The architecture is genuinely different: instead of ingesting and re-indexing logs into a proprietary store, ChaosSearch indexes data directly in your own S3 (or GCS) bucket, with Elasticsearch and SQL APIs on top. The result is that storage cost is what S3 charges (cents per GB per month) and the index tax that consumes 30-70% of every per-GB vendor invoice disappears. Customers report decisive cost wins at 10 TB per day and above. The company raised a $40M Series B in 2021 and has positioned almost entirely on cost-disruption. The trade-offs: live tail and sub-second interactive search are less snappy than Datadog or Better Stack, the product is opinionated about data already in object storage, and the integration ecosystem is narrower than the broad-market vendors.
High-volume engineering and security teams (500-10,000 employees) at 10 TB per day and above where per-GB ingest pricing is a board-level cost conversation.
Low-volume teams under 1 TB per day, dashboards-first SRE workflows, or buyers wanting bundled status pages and incident management.
Strengths
- Indexes data directly in your S3 or GCS bucket; no re-ingest
- Storage cost is what S3 or GCS charges (cents per GB per month)
- Index tax eliminated; 30-70% cost reduction versus per-GB vendors at scale
- Elasticsearch API plus SQL API; familiar query surfaces
- Decoupled compute scales independently of storage
- Strong fit for petabyte-per-day log volumes
Weaknesses
- Live tail and sub-second search less snappy than Datadog or Better Stack
- Opinionated about data being in object storage already
- Smaller integration ecosystem
- Cost wins are decisive at 10 TB per day and above, less so below 1 TB per day
- On-call incident workflow not a primary product surface
Pricing tiers
partial- StandardPer-TB indexed; customer owns S3 or GCS storage costQuote
- EnterpriseCustom volumes; private deployment optionsQuote
- · Customer pays S3 or GCS storage directly (typically a feature)
- · Compute scaling billed separately for very high query loads
Key features
- +S3 and GCS native indexing
- +Elasticsearch-compatible API
- +SQL API
- +No re-ingest; data stays in customer bucket
- +Decoupled compute scaling
- +Multi-account isolation
- +Long-term retention at S3 economics
Frequently asked questions
The questions buyers actually ask before they sign.
Is there an ANSSI-qualified log management product for French OIVs?
How does CNIL guidance affect log retention policies in France?
Should French companies use Datadog Logs or consider OVHcloud alternatives?
Log management vs APM: which do I need?
Log management vs SIEM: where is the line?
Why does my Datadog log bill keep surprising me?
How does open-source compare to proprietary log management?
Should the SolarWinds SUNBURST incident still affect my procurement of Loggly or Papertrail?
What does S3-native log analytics actually mean for cost?
How does observability convergence affect log management buying?
How long is log management implementation typically?
What about free tiers and trials?
How does AI fit into log management in 2026?
Final word
Looking at a different market? See the global Log Management Software ranking, or pick another country at the top of this page.
Last updated 2026-05-19. Local pricing reverified quarterly. Found something inaccurate? Tell us.