What I like most about Elastic Observability is its ability to bring logs, metrics, traces and application performance monitoring together on a single platform. It provides end-to-end visibility into applications and infrastructure, making it easier to identify bottlenecks, troubleshoot issues and reduce resolution time.

Its powerful search capabilities, customizable dashboards, real-time monitoring and integration with various technologies are particularly useful. I also like its scalability and flexibility, which allow teams to tailor observability to their specific requirements and gain actionable insights from large volumes of data. Review collected by and hosted on G2.com.

If I were evaluating Elastic Observability from an IT Project Manager, DevOps or SRE perspective, my main concerns would be its learning curve, infrastructure overhead, pricing complexity and the effort required to maintain it.

Based on publicly available user reviews and documented product limitations, these are the areas I would scrutinize. Review collected by and hosted on G2.com.

Elastic Security provides strong security analytics, centralized visibility, and effective threat detection capabilities. I particularly like how security data, logs, and events can be analyzed in one platform, making it easier to investigate suspicious activity and identify potential threats. Review collected by and hosted on G2.com.

The platform offers many capabilities, which can make the initial setup and configuration a little complex. Getting the most out of advanced detection and security features may also require some learning and technical expertise. Review collected by and hosted on G2.com.

Elastic Security is a top-tier choice for SOC analysts, offering rapid alert triage and smart filtering to easily separate true threats from noise. It features granular timelines that provide full investigation context, tracking process trees and connections in a single pane. The platform leverages standardized, enriched logs via the Elastic Common Schema (ECS) to unify disparate telemetry. High-speed query engines like KQL and ES|QL enable fast searches and advanced threat hunting across massive datasets without performance drops. Additionally, its out-of-the-box detection rules mapped to MITRE ATT&CK streamline detection engineering, though occasional timeline-loading glitches remain a minor drawback. Review collected by and hosted on G2.com.

Occasional Timeline Freezes: When pulling wide timeframes or dealing with dense event clusters, the graphical timeline view can hang, stutter, or fail to load completely, forcing analysts to fall back to raw Discover queries. Review collected by and hosted on G2.com.

It unifies SIEM, endpoint protection, and threat hunting on one platform, backed by Elasticsearch's fast search across huge volumes of security data. Hundreds of prebuilt, open detection rules mapped to MITRE ATT&CK, built-in ML anomaly detection, and AI-assisted investigation help us detect and respond to threats quickly without juggling multiple tools. Review collected by and hosted on G2.com.

Detection rules need significant tuning to cut false positives, and setup and cluster management demand strong expertise. The interface can feel complex for new analysts, and resource and storage costs rise quickly as log ingestion grows. Review collected by and hosted on G2.com.

I like Elastic Security’s unified platform, along with its powerful threat detection, real-time analytics, and flexible search capabilities. Together, these features make it easier to detect, investigate, and respond to security threats from a single place. Review collected by and hosted on G2.com.

The initial learning curve can feel steep, especially for new users. Some of the more advanced security features also require deeper technical expertise and careful configuration to use effectively. In addition, the user interface and documentation could be more intuitive, which would help speed up adoption and make it easier to get started. Review collected by and hosted on G2.com.

The query speed is very good. Being able to search through massive logs in seconds saves the team a lot of time during incident response. Review collected by and hosted on G2.com.

Setup and maintenance is what i dislike more because it takes very much time to get in place. Review collected by and hosted on G2.com.

Elastic Security runs on the Elastic Common Schema (ECS), meaning host data, network data, container metrics, and identity events share a unified data model out of the box. Review collected by and hosted on G2.com.

Significant Operational Overhead & Cluster Maintenance

Infrastructure burden: Unless you are paying a premium for Elastic Cloud, self-hosting or managing Elastic clusters requires specialized DevOps/platform engineering skills. Review collected by and hosted on G2.com.

What I like best about Elastic Security is the flexibility and depth it gives across SIEM, endpoint, and observability in a single platform. I can ingest almost any data source, normalize it to ECS, and build detections that actually reflect how our environment works—rather than forcing our workflows to fit a rigid tool. The visibility, correlation, and customisation make it especially powerful for real-world SOC operations and complex environments. Review collected by and hosted on G2.com.

What I dislike about Elastic Security is the learning curve and operational overhead, especially for teams new to the Elastic Stack. Getting the most value requires strong knowledge of ECS, ingest pipelines, and cluster tuning, and some advanced use cases still involve a fair amount of manual configuration. The flexibility is powerful, but it can be overwhelming without experienced resources or good upfront design. Review collected by and hosted on G2.com.

Useful and end point protection Unmatched Search Speed at Scale: Review collected by and hosted on G2.com.

Unlike SaaS SIEM solutions that work right out of the box, setting up, tuning, and maintaining Elastic Security requires dedicated operational knowledge Review collected by and hosted on G2.com.

Hands-on experience with ELK SIEM for log monitoring, detection rule creation, threat hunting, alert investigation, dashboards, and SIEM administration. Review collected by and hosted on G2.com.

The learning curve can be steep, especially for advanced configurations, troubleshooting, and large-scale deployments Review collected by and hosted on G2.com.