What do you use for log aggregation?

Running a mix of scrubbing centers and anycast nodes across three regions. Currently shipping logs from edge filters to a self-hosted ELK stack on a 16-core at OVHcloud. Indexing ~400GB/day of flow data, SYN fingerprints, filtered vs passed breakdowns.

ELK is eating 48GB RAM just for Elasticsearch. Looking at Loki but worried about query performance on 500Gbps+ attack forensics—need sub-minute drill-down when under fire.

Anyone running Loki at scale for DDoS analysis? Or is the "just grep it" crowd actually onto something for low-volume setups?

I just grep /var/log when things break never had a problem danfra you are overthinking this I have 200 clients on a Contabo reseller box and I just ssh in and tail -f when they complain works every time

This works until you need correlation across anycast nodes during a route leak or filtering event. grep is O(n) on uncompressed logs; Elasticsearch inverted indices are O(log n) with proper shard allocation.

Danfra: Loki's advantage is label-based indexing—if your labels are {pop=, scrubber=, attack_vector=} you avoid the full-text overhead. But Loki lacks Elasticsearch's aggregations for BGP community analysis. For 500Gbps forensics, consider: Loki for real-time tail, Elasticsearch for post-mortem with community string filtering. RPKI invalid drops logged separately with ROA status in labels.

I've seen transit pricing discussions where log storage exceeds port costs at 10Gbps+. Factor retention into your IRR update budget.

¡I use the Loki in the server red! The filters they work good for the traffic DDoS. But the queries they are slow in the logs old, yes. In the provider Contabo I have the retention of 7 days only, and for the audits GDPR you need more time, no?

¡The grep it is tool of the emergency, not of the production!