Logging & SIEM¶

Forwarders and dashboards are fully offline. The multi-GB SIEM servers ship as compose files you pull once, by design — see limitations.

service

Lightweight log/metrics forwarder — the workhorse shipping side.

service

Dashboards for anything with a datasource — Loki included.

system

Observability data pipeline — route logs/metrics between anything.

binary

Grafana's log-aggregation backend, indexed by label not full text.

manual

Requires a splunk.com login, so it can't be fetched during the build.

compose

Not pre-pulled (multi-GB images) — a ready compose file is staged instead.

compose

Same policy as Elastic — staged compose, pulled on demand.

compose

Open-source XDR/SIEM. Upstream's own compose changes per release, so it's fetched fresh rather than pinned stale.

compose

Log management on Mongo + OpenSearch — staged compose, pulled on demand.

compose

Full packet-capture search-and-analysis system.