Reviews

The first strength worth calling out is SPL itself. In practice, the Search Processing Language is the most powerful log query language I've used. I can write a single search that correlates Kubernetes pod crash loops from our EKS clusters with AWS CloudTrail API call failures and on-prem AD authentication events, all in one view. When we had a cascading failure last year that started with an expired IAM role and ended with stuck Helm deployments across two regions, SPL was how we traced the full chain in under an hour. No other tool in our stack could have done that. The second strength is the alerting and dashboard maturity. This isn't a tool where you build dashboards once and nobody looks at them. Our operations team has daily driver dashboards for ESK cluster health, data pipeline throughput, and deployment success rates. The alerts are granular enough that we can page on specific error patterns rather than just log volume spike. After running it for a few years, those dashboards have become the source of truth during incident calls and honestly that's the best compliment I can give an observability tool. Third, the forwarder architecture is quietly excellent. We run universal forwarders on hundreds of endpoints -- Linux servers, Windows hosts, container sidecars -- and they just work. I can count on one hand the number of forwarder-related incidents we've had in 3 years. For something that runs on every server we own, that kind of reliability matters more than any flashy feature.

March 6, 2026