TL;DR: Compare the queries you need, operating ownership, access controls, retention and total cost at expected and incident volumes. Product names do not determine the answer: self-managed and hosted options exist, and licensing and pricing depend on the chosen offering.
How to approach it
Establish required searches, data residency, retention, volume and staffing. Compare a short list against those constraints, then make a conditional recommendation supported by a representative workload.
A strong answer
Self-hosted Elasticsearch and Kibana, with a suitable collector, provide indexing and search that your team must operate. Evaluate shard sizing, storage tiers, upgrades, recovery and licensed features. Include the cost of operators and spare capacity; do not assume every capability is available without a licence.
Grafana Loki indexes stream labels rather than every log field. Query cost depends on how much matching data must be scanned, as well as available acceleration and storage. Test your actual searches and control label cardinality. Existing Grafana experience may reduce integration work but does not establish the cheapest total cost.
Splunk offers search and analysis capabilities used in operational and security workflows. Evaluate the deployment option, access controls, required integrations and contract pricing. Include migration effort for existing searches and detection rules; feature depth only helps when it serves a stated requirement.
Datadog and other managed platforms can integrate logs with metrics and traces. Test correlation using your instrumentation, then model ingestion, indexing, retention and any other applicable charges from the current offer. Managed operation still leaves your team responsible for collection, redaction, access and cost controls.
The recommendation should follow the evidence. A managed option can suit a team without capacity to operate a cluster. Self-hosting can suit established operational expertise or specific deployment constraints. There is no volume threshold that makes either choice universally cheaper.
Decide which records must be retained before optimising volume. Sample repetitive low-value events, retain necessary audit evidence, and bound repeated errors without losing their counts or diagnostic examples. Set hot and archive retention from investigation needs and applicable requirements.
Make the comparison reproducible
Use an illustrative workload of 200 GB ingested daily, 30 days searchable, and a separate 180-day archive requirement. Those are planning inputs, not a universal retention policy. Estimate compression, replicas, indexing, archive retrieval, cross-region transfer and operator time. Then model a tenfold error storm: a low average bill does not show whether collection will drop the evidence needed during an outage.
Replay a redacted sample into candidate systems and run the same tasks: find one request across services, search a rare error across a week, restrict one team's access, and retrieve an archived incident window. Record query latency, operator steps, dropped records and cost under the intended configuration. Include an unavailable destination to test collector buffering and disk limits.
A recommendation might favour a managed service when the team cannot staff a search cluster, provided residency and query needs pass. An existing, well-operated internal platform may change that result. Name the assumption that would reverse your choice, and verify the vendor's current contract before attaching a price.
What interviewers probe next
"How do you avoid lock-in?" Emit structured logs and ship through a vendor-neutral collector, OpenTelemetry or Fluent Bit, so the destination is configuration. Writing vendor SDK calls into application code is what makes a migration a rewrite.
"What about compliance and data residency?" Often the whole decision. Logs contain personal data, so a managed platform means processing agreements, a region choice, and a retention policy you can defend. That is frequently what rules out a vendor regardless of price.
"How do you keep sensitive data out?" Redact at the collector, before it leaves the host, because once a token is indexed it is in backups and in the vendor's storage. Scrubbing at query time protects nothing.
Common mistakes
Assuming search features are interchangeable without testing the queries and access controls the team needs.
Modelling cost at today's volume, then being surprised when the bill tracks growth faster than revenue does.
Running self-hosted Elasticsearch without anyone owning it, which works until the first cluster incident.
Logging everything at info and solving the resulting bill by shortening retention, which removes the old data you needed and keeps the noise.