Alek's Blog - logging

AWS vs. GCP vs. Azure vs. OVHcloud: The Complete Guide to Managed Log Archiving

aleks — Thu, 14 May 2026 00:00:00 +0000

This is the index and reading guide for a six-part series comparing managed log archiving on AWS, GCP, Azure, and OVHcloud for retention periods of seven years or more. It is written for teams that have to choose between a hyperscaler’s managed log service and a self-hosted alternative on OVH, and who need the comparison grounded in real prices, real API behaviour, and real operational constraints rather than marketing copy. Each part stands on its own; together they walk the full lifecycle of a long-term log archive — from what it costs, through how it is built and secured, to how it is run and audited years after the first log lands.

AWS vs. GCP vs. Azure vs. OVHcloud: Log Archiving Operations

aleks — Thu, 14 May 2026 00:00:00 +0000

This post covers the operational dimension of the managed log archiving comparison</a>: how each provider integrates with Kubernetes, what ingest pipeline options exist, how backup and disaster recovery work, and how you observe the log pipeline itself.

Log Archiving Pre-Flight & Auditor Export: AWS / GCP / Azure / OVHcloud

aleks — Thu, 14 May 2026 00:00:00 +0000

This post continues the managed log archiving series with three operational questions that rarely appear in provider documentation: what must be done before writing the first log, what cannot be changed retroactively, and how to export logs to an external auditor in a tamper-evident way.

Full guide: AWS vs. GCP vs. Azure vs. OVHcloud: The Complete Guide to Managed Log Archiving</a></li>
Part 1 — Overview & Cost:</a> Services, storage model, 7-year cost comparison</li>
Part 2 — Pre-Flight, Flexibility & Auditor Export — this post</li>
Part 3 — Operations:</a> Kubernetes integration, ingest pipeline, backup & DR</li>
Part 4 — Security & Compliance:</a> IAM/RBAC, encryption, WORM, GDPR, compliance certificates</li>
Part 5 — Query, Dashboards & Recommendations:</a> Query interfaces, dashboards, alerting, cold-tier behaviour</li>
Part 6 — Production Checklist, Guardrails & Runbooks:</a> Loss detection, privacy, schema, cost guardrails, runbooks, fire drills</li> </ul>

7-Year Log Archiving in Production: Checklist, Guardrails & Runbooks

aleks — Thu, 14 May 2026 00:00:00 +0000

Choosing the provider and storage tier is only half of the work. A seven-year log archive is a production system: it must prove that logs are complete, protect personal data, keep query costs bounded, survive access-key and restore failures, and give auditors repeatable evidence without turning every audit into an incident.
This final part turns the provider comparison into an operating checklist.

Full guide: AWS vs. GCP vs. Azure vs. OVHcloud: The Complete Guide to Managed Log Archiving</a></li>
Part 1 — Overview & Cost:</a> Services, storage model, 7-year cost comparison</li>
Part 2 — Pre-Flight, Flexibility & Auditor Export:</a> Pre-flight checklist, retroactive flexibility, auditor export</li>
Part 3 — Operations:</a> Kubernetes integration, ingest pipeline, backup & DR</li>
Part 4 — Security & Compliance:</a> IAM/RBAC, encryption, WORM, GDPR, compliance certificates</li>
Part 5 — Query, Dashboards & Recommendations:</a> Query interfaces, dashboards, alerting, cold-tier behaviour, when to use which</li>
Part 6 — Production Checklist, Guardrails & Runbooks — this post</li> </ul>

Log Archiving Security & Compliance: AWS / GCP / Azure / OVHcloud

aleks — Thu, 14 May 2026 00:00:00 +0000

This post covers the security and compliance dimension of the managed log archiving comparison</a>: encryption, access control, immutability for regulatory retention, GDPR, and compliance certifications relevant for EU/DACH environments.

Full guide: AWS vs. GCP vs. Azure vs. OVHcloud: The Complete Guide to Managed Log Archiving</a></li>
Part 1 — Overview & Cost:</a> Services, storage model, 7-year cost comparison</li>
Part 2 — Pre-Flight, Flexibility & Auditor Export:</a> Pre-flight checklist, retroactive flexibility, auditor export</li>
Part 3 — Operations:</a> Kubernetes integration, ingest pipeline, backup & DR</li>
Part 4 — Security & Compliance — this post: IAM/RBAC, encryption, WORM, GDPR, compliance certificates</li>
Part 5 — Query, Dashboards & Recommendations:</a> Query interfaces, dashboards, alerting, cold-tier behaviour, when to use which</li>
Part 6 — Production Checklist, Guardrails & Runbooks:</a> Loss detection, privacy, schema, cost guardrails, runbooks, fire drills</li> </ul>
Self-hosted alternative: Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse — Part 3 (Security)</a>

Log Archiving Query & Recommendations: AWS / GCP / Azure / OVHcloud

aleks — Thu, 14 May 2026 00:00:00 +0000

This post covers query interfaces, dashboard building, alerting, and cold-tier query behaviour for the managed log archiving comparison</a>, and closes with concrete recommendations for each scenario.

Full guide: AWS vs. GCP vs. Azure vs. OVHcloud: The Complete Guide to Managed Log Archiving</a></li>
Part 1 — Overview & Cost:</a> Services, storage model, 7-year cost comparison</li>
Part 2 — Pre-Flight, Flexibility & Auditor Export:</a> Pre-flight checklist, retroactive flexibility, auditor export</li>
Part 3 — Operations:</a> Kubernetes integration, ingest pipeline, backup & DR</li>
Part 4 — Security & Compliance:</a> IAM/RBAC, encryption, WORM, GDPR, compliance certificates</li>
Part 5 — Query, Dashboards & Recommendations — this post</li>
Part 6 — Production Checklist, Guardrails & Runbooks:</a> Loss detection, privacy, schema, cost guardrails, runbooks, fire drills</li> </ul>
Self-hosted alternative: Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse — Part 4 (UX)</a>

AWS vs. GCP vs. Azure vs. OVHcloud: Managed Log Archiving for 7+ Years

aleks — Thu, 14 May 2026 00:00:00 +0000

Long-term log archiving at scale is an expensive problem. Cloud providers offer a wide range of managed services for ingesting, storing, and querying logs — and the cost differences between them are dramatic. This series covers AWS, GCP, Azure, and OVH along the axes that matter for 7-year archival: services available, storage model, ingest cost, 7-year total cost at 100 GB/day, Kubernetes integration, security, and query interfaces.
Full guide: AWS vs. GCP vs. Azure vs. OVHcloud: The Complete Guide to Managed Log Archiving</a></li>
Part 1 — this post: Services overview, storage model, and 7-year cost comparison</li>
Part 2 — Pre-Flight, Flexibility & Auditor Export:</a> Pre-flight checklist, retroactive flexibility, auditor export</li>
Part 3 — Operations:</a> Onboarding, Kubernetes integration, ingest pipeline, backup & DR</li>
Part 4 — Security & Compliance:</a> IAM/RBAC, encryption, WORM, GDPR, compliance certificates</li>
Part 5 — Query, Dashboards & Recommendations:</a> Query interfaces, dashboards, alerting, cold-tier behaviour, when to use which</li>
Part 6 — Production Checklist, Guardrails & Runbooks:</a> Loss detection, privacy, schema, cost guardrails, runbooks, fire drills</li> </ul>
Self-hosted alternative: Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse</a> — tiering, compression, resource consumption, SaaS options.

Retaining logs for seven or more years is a very different problem than storing the last 30 days of operational logs. Ingest cost per GB, the ability to query old data without restoring from tape, and long-term pricing predictability dominate over query latency. Each of the four providers covered here has a fundamentally different answer to this problem — and for at least one of them, the honest answer is “our managed offerings are not designed for this; run it yourself instead.”

Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: The Complete Guide

aleks — Thu, 14 May 2026 00:00:00 +0000

This is the index and reading guide for a five-part series comparing Elasticsearch, OpenSearch, Grafana Loki, Quickwit, and ClickHouse as backends for long-term log archiving — retention measured in years, not days. It is for anyone choosing or operating a log-storage backend: the comparison is empirically grounded across storage tiering, operations, security, and day-to-day usability, and closes with a full working ClickHouse pipeline running on OVH Managed Kubernetes Service (MKS).

Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: Kubernetes Operations, Backup & DR

aleks — Thu, 14 May 2026 00:00:00 +0000

Cluster setup, ingest pipelines, and backup & disaster recovery differ significantly across Elasticsearch, OpenSearch, Grafana Loki, Quickwit, and ClickHouse — and these differences often matter more than raw performance when a log archive must run reliably for 7+ years.
This is Part 2 of a five-part series.
Full guide: Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: The Complete Guide</a></li>
Part 1 — Comparison:</a> Storage tiering, compression, resource consumption, query languages, SaaS options</li>
Part 2 — Operations — this post: Setup, ingest pipeline, ECS vs. OTel, backup & DR, observability, alerting</li>
Part 3 — Security & Compliance:</a> Encryption, RBAC, WORM / S3 Object Lock</li>
Part 4 — UX, Dashboards & Alerts:</a> UI layers, log search UX, cold-tier query behaviour, dashboard building, sharing, alerting</li>
Part 5 — Use Case:</a> Vector, Istio/Envoy, nginx, Java on OVH MKS — complete ClickHouse ingestion setup and monthly awffull report</li> </ul>

Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: Security & Compliance

aleks — Thu, 14 May 2026 00:00:00 +0000

Access control, encryption, and immutability requirements often determine whether a log archive can be used for compliance purposes — and the five systems differ substantially in what they enforce natively versus what must be delegated to infrastructure.
This is Part 3 of a five-part series.

Full guide: Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: The Complete Guide</a></li>
Part 1 — Comparison:</a> Storage tiering, compression, resource consumption, query languages, SaaS options</li>
Part 2 — Operations:</a> Setup, ingest pipeline, ECS vs. OTel, backup & DR, observability, alerting</li>
Part 3 — Security & Compliance — this post: Encryption, RBAC, WORM / S3 Object Lock</li>
Part 4 — UX, Dashboards & Alerts:</a> UI layers, log search UX, cold-tier query behaviour, dashboard building, sharing, alerting</li>
Part 5 — Use Case:</a> Vector, Istio/Envoy, nginx, Java on OVH MKS — complete ClickHouse ingestion setup and monthly awffull report</li> </ul>

ClickHouse Use Case: Vector, Istio, nginx, Java on OVH MKS

aleks — Thu, 14 May 2026 00:00:00 +0000

The first four parts of this series compared Elasticsearch, OpenSearch, Loki, Quickwit, and ClickHouse across storage models, operations, security, and UX. This part shows what a concrete production setup looks like when the decision has been made: ClickHouse as the log store, Vector as the ingestion agent, running on OVH Managed Kubernetes Service (MKS) with OVH Object Storage as the cold tier.
This is Part 5 of a five-part series:
Full guide: Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: The Complete Guide</a></li>
Part 1</a> — storage models, compression, resource consumption, and SaaS options</li>
Part 2</a> — cluster setup, Kubernetes operations, backup and disaster recovery</li>
Part 3</a> — encryption, RBAC, and WORM compliance</li>
Part 4</a> — UI layers, dashboards, alerting, and cold-tier query behaviour</li>
Part 5 — this post</li> </ul>

Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: UX, Dashboards & Alerts

aleks — Thu, 14 May 2026 00:00:00 +0000

Day-to-day operability of a log archive depends less on storage internals and more on what happens when an engineer opens a browser and searches for the cause of last Tuesday’s outage — or, years later, a compliance auditor queries a 4-year-old event trail. The five systems differ substantially in the quality of their search UI, how well they support dashboard building and sharing, and how (or whether) they handle alerts natively. This post covers all of those dimensions.
This is Part 4 of a five-part series.

Full guide: Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: The Complete Guide</a></li>
Part 1 — Comparison:</a> Storage tiering, compression, resource consumption, query languages, SaaS options</li>
Part 2 — Operations:</a> Setup, ingest pipeline, ECS vs. OTel, backup & DR, observability, alerting</li>
Part 3 — Security & Compliance:</a> Encryption, RBAC, WORM / S3 Object Lock</li>
Part 4 — UX, Dashboards & Alerts — this post: UI layers, log search UX, cold-tier query behaviour, dashboards, sharing, alerting</li>
Part 5 — Use Case:</a> Vector, Istio/Envoy, nginx, Java on OVH MKS — complete ClickHouse ingestion setup and monthly awffull report</li> </ul>

Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: Long-Term Log Archiving for 7+ Years

aleks — Thu, 14 May 2026 00:00:00 +0000

Long-term log archiving is a deep topic. Each of the five systems covered here has its own tiering model, object storage integration, query language, operational quirks, and security posture. To do it justice, this comparison is split across five posts — take your time reading them, and don’t hesitate to come back to individual sections more than once.
Full guide: Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: The Complete Guide</a></li>
Part 1 — this post: Storage tiering, compression, resource consumption, query languages, SaaS options</li>
Part 2 — Operations:</a> Setup, ingest pipeline, ECS vs. OTel, backup & DR, observability, alerting</li>
Part 3 — Security & Compliance:</a> Encryption, RBAC, WORM / S3 Object Lock</li>
Part 4 — UX, Dashboards & Alerts:</a> UI layers, log search UX, cold-tier query behaviour, dashboard building, sharing, alerting</li>
Part 5 — Use Case:</a> Vector, Istio/Envoy, nginx, Java on OVH MKS — complete ClickHouse ingestion setup and monthly awffull report</li> </ul>

Storing logs for compliance, auditing, or forensic purposes often means retaining data for seven years or more. That is a very different problem than storing the last 30 days of operational logs. Hot-tier query latency matters less; cost per GB, the ability to still search old data without restoring it manually, and the operational burden of keeping the system alive for years become the dominant concerns.
This post compares five systems — Elasticsearch</a>, OpenSearch</a>, Grafana Loki</a>, Quickwit</a>, and ClickHouse</a> — along the axes that matter for long-term archiving: tiering, object storage integration, compression, resource consumption during ingest/compact/search, and available SaaS options. A separate section covers systems that were evaluated but are not recommended for this use case.