Comparison of ELK, EFK, and PLG Log Systems

1. ELK Log System: The classic ELK architecture, also known as Elastic Stack, consists of Elasticsearch, Logstash, Kibana, and Beats. Beats collect logs, Logstash aggregates and processes them, Elasticsearch stores and searches logs, and Kibana provides visual front‑end display.

2. EFK Log System: In containerized environments, especially Kubernetes, the EFK architecture is common. F stands for Fluent Bit, an open‑source multi‑platform log processor and forwarder that can collect data from various sources, forward to multiple destinations, and fully support Docker and Kubernetes.

3. PLG Log System (Promtail + Loki + Grafana): Grafana Labs offers the PLG stack, where Promtail collects logs, Loki stores them with label‑based indexing, and Grafana visualizes the data. Loki indexes only log labels, reducing storage cost and improving efficiency, while Grafana provides dashboards for time‑series and log data.

Grafana is an open‑source visualization and analysis tool that supports many data sources. Loki’s design, inspired by Prometheus, enables a horizontally scalable, highly available multi‑tenant log system.

Promtail acts as a log collection agent, discovering targets, attaching labels, and pushing logs to Loki; it currently supports local log files and systemd logs on AMD64.

4. PLG vs ELK Comparison:

4.1 ES vs Loki: Elasticsearch stores logs as unstructured JSON objects with full indexing for full‑text search, whereas Loki decouples storage, allowing disk or cloud (e.g., Amazon S3) storage and indexes only label pairs, lowering indexing cost but requiring LogQL for content queries.

4.2 Fluentd vs Promtail: Promtail is tailored for Loki, providing service discovery for Kubernetes pods and attaching the same labels used by Prometheus, enabling unified label management.

4.3 Grafana vs Kibana: Kibana offers rich visualizations and advanced features like anomaly detection, while Grafana focuses on time‑series data and can display logs and metrics together on the same dashboard.