G2

Verified User in Computer & Network Security

Mid-Market (51-1000 emp.)

8/24/2026

"Fast, Scalable Elasticsearch for Real-Time Security Monitoring and Threat Hunting"

4/5

What do you like best about Elasticsearch?

Elasticsearch stands out for its speed, scalability, and powerful search capabilities. I especially appreciate how easily it can ingest and correlate large volumes of security and operational data. KQL, the Elasticsearch Query DSL, and Kibana also make investigations and visualizations very flexible. Overall, it’s particularly effective for real-time security monitoring, threat hunting, alerting, and building custom dashboards. Review collected by and hosted on G2.com.

What do you dislike about Elasticsearch?

The biggest drawback for me is how complex it can be to manage and tune Elasticsearch at scale. Tasks like index management, shard sizing, mappings, retention policies, and keeping resource consumption under control often require significant expertise. Kibana setup and detection-rule configuration can also get complicated, especially in large environments with high event volumes. On top of that, licensing costs for advanced security and observability features may be an important consideration for organizations running large deployments. Review collected by and hosted on G2.com.

What problems is Elasticsearch solving and how is that benefiting you?

Elasticsearch helps us centralize and analyze large volumes of security and operational data from endpoints, servers, network devices, and applications. With real-time search, dashboards, and automated detection rules, it supports faster alert investigation, threat hunting, log correlation, and the detection of suspicious activity. Overall, it has significantly improved our SOC visibility and incident response, reduced investigation time, and made it easier to spot patterns and potential threats across our environment. Review collected by and hosted on G2.com.