What do you like best?
Time to market:
- Because Sumologic is a SAAS product, I don't need to run an ELK stack or manage any logging / storage infrastructure.
- Because Sumologic is a supported product, I have full access to a team of engineers who wrote the software and to customer success engineers to help leverage the all the features and debug mistakes
- Because Sumologic stores the raw logs, I can always refine and clean up the data in ad-hoc queries over historical data
- Because of the flexible query language, I can iterate on a data pipeline in minutes instead of hours or days (I'm looking at you DataFlow)
Taken as a whole, these features make it possible to quickly build out and iterate on complex log data.
Because Sumologic holds the raw logs (not just metrics), its always possible to clean the data in a way that would not be possible using only
What do you dislike?
- Enriching the data is somewhat hard
- Under load the UI is not as responsive as I would like
- Exporting the enriched data is somewhat hard
- For my use case, its very difficult to make reusable portions of queries that are shared by many searches / dashboard panels
- The tradeoff with log analysis tools like Sumo and others versus metric-based data is that complex queries take more time. This isn't a Sumologic problem, its just the downside of the flexibility that comes with log in general
- For large scale projects , care must be taken to stay within the various limits -- though compared to other tools like OpenTSDB Sumologic is much less limited
Recommendations to others considering the product
Think about total cost of ownership before choosing either an open source product (like OpenTSDB, ELK, Graylog, or InfluxDB). In particular, estimate:
* Capacity Planning -- what load will monitoring analytics solution need to handle at peak? Do you have staff with experience scaling out that platform to that scale? Are the scaling characteristics of this product at that scale well understood?
* Data ingest costs in your preferred cloud / on-premise hosting solution and how much infrastructure you'll need to ingest that data.
* Support Contracts -- How much will a support contract cost to help you get unstuck quickly?
* Time to build out an MVP -- will you need to manage lots of infrastructure yourself? Can you leverage an in-house operational team that will immediately prioritize your project above other work? (In many cases, in house teams are already over-committed in my experience)
* Familiarity with the Data -- if you already understand the data well (from working with it in a different product for example), you may not need the flexibility of Sumologic
* Cycle Time - How long will it take to make a single small change to your MVP? Minutes or days? Whats your dead line to having an acceptable version in production?
In short, if you are cash rich and time poor but need to iterate and scale rapidly, look at a SAAS offering like Splunk, Sumologic, or Elastic. In many cases, Sumologic will actually win on price over the offerings and for me, I've seen Sumologic perform well at high scale.
If you are time rich and cash poor or already understand your dataset / problem domain well AND you don't expect to scale out your system significant in the next 2 to 5 years, you might be able to save money by oeprating an open source product in house. However, you will almost certain pay with your development and maintenance time.
What business problems are you solving with the product? What benefits have you realized?
Overall business objective: Detection and understand root causes of problems with network traffic for online video.
- Faster time to market
- Reduced maintenance
- Customer support
- Domain expertise
- Fast Iteration