Open-source Mezmo alternatives

Loki is a log aggregation system from Grafana, described as Prometheus for logs. It is horizontally scalable, highly available and multi-tenant. Instead of indexing the contents of log lines, it indexes a set of labels for each log stream and stores the compressed log text, which the project says makes it simpler to operate and cheaper to run. It is written in Go and released under the AGPL-3.0 license.

Because Loki reuses the labels familiar from Prometheus, you can move between metrics and logs using the same label sets, and it has native support in Grafana. It works especially well for Kubernetes pod logs, since metadata such as pod labels is scraped and indexed automatically. A typical stack has three parts: Alloy as the collection agent, Loki for storage and queries, and Grafana for exploration. Alloy replaces Promtail, which is considered feature complete. Unlike Prometheus, Loki receives logs by push.

Vector is a high-performance observability data pipeline that works both as an agent and as an aggregator. It collects logs and metrics from many sources, transforms them, and routes them to whichever vendors or storage systems you choose, so you can switch or combine backends without changing how data is collected.

The project argues that this gives you control over your telemetry: you can cut costs by filtering and shaping data before it reaches a paid vendor, enrich events in new ways and apply data security where you need it rather than where it is most convenient for a vendor. It also claims to be substantially faster than comparable tools. Built in Rust, its primary design goal is reliability, and topics mention traces, stream processing and ETL.

Datadog's open-source engineering team maintains Vector, which is licensed under MPL-2.0. The README offers a quickstart, installation guides, integrations and container images. Because it is software you run yourself, it needs no hosted service, and it suits platform and SRE teams that manage large volumes of logs and metrics.

OpenObserve, often shortened to O2, is open-source observability software spanning logs, metrics, traces and analytics, real user monitoring on web, Android and iOS, session replay, pipelines, SLOs and AI and LLM observability. It is pitched as a lower-cost option next to Datadog, Splunk and Elasticsearch for teams that want complete observability without the complexity or price.

Its architecture uses Parquet columnar storage and an S3-native design, which the project says can cut storage costs by up to 140 times compared with Elasticsearch, with petabyte-scale capacity. Topics reference OpenTelemetry, Prometheus, Jaeger and Kibana, showing the standards and tools it interoperates with. The README has sections on architecture, comparisons, production readiness, security and compliance, and an enterprise edition.

OpenObserve is AGPL-3.0 licensed, with a hosted cloud option and a self-hosted deployment, and documentation and a Slack community are provided. It suits engineering teams looking to consolidate logging, metrics and tracing in one tool while keeping storage costs under control.

Telegraf is an agent for gathering, processing, aggregating and writing metrics, logs and other kinds of data. It comes from InfluxData and is commonly paired with InfluxDB, but it can write to many other destinations, so it works as a general-purpose collector in monitoring pipelines.

Its strength is a library of more than 300 plugins that cover devices such as OPC UA and Modbus, logs from files and directories, messaging systems like AMQP, Kafka and MQTT, monitoring standards such as OpenTelemetry and Prometheus, networking gear, and system metrics for CPU, memory, disk, network, S.M.A.R.T., Docker and Nvidia GPUs. Universal plugins like Exec and HTTP let you run your own code to collect or transform data. Telegraf compiles to a standalone static binary with no external dependencies, and it is configured in TOML.

The project, written in Go and MIT licensed, has more than a thousand contributors. It is run on the machines you want to monitor, and suits sysadmins, IoT engineers and observability teams that want one flexible agent instead of many specialized exporters.

Logstash is part of the Elastic Stack alongside Beats, Elasticsearch and Kibana. It is a server-side data processing pipeline that ingests data from many sources at once, transforms it, and then ships it to a storage destination, with Elasticsearch being the natural target in Elastic's own stack. It is built with Java and JRuby.

Its functionality comes from plugins. The project says Logstash has over 200 plugins, hosted in separate repositories under the logstash-plugins GitHub organization, and each plugin is a self-contained Ruby gem published to RubyGems.org. Writing your own plugin is described as easy, with documentation on developing and testing them.

Official binaries and Debian and RPM packages are available from the downloads page, and documentation, a forum and Elastic support channels are listed. Development of the core requires JDK 21. The repository lists the license as 'Other', so the license files should be reviewed for exact terms.

Graylog is a log management server written in Java and described by its maintainers as free and open. It centralizes log data from many systems so teams can search, view and analyze events in one place instead of connecting to each machine individually.

The repository topics point to support for common log formats and transports, including GELF and syslog, along with Kafka and AMQP inputs. Topics also place the project in log analysis, log collection, secure logging and SIEM territory, which reflects its use for monitoring and security work. Specific features were not available when this entry was written, because the vendor website could not be read.

This entry covers the OpenTelemetry Collector, the component of the OpenTelemetry project that handles telemetry data in transit. It is a vendor-agnostic implementation for receiving, processing and exporting telemetry, so teams do not need to run separate agents or collectors for each open-source telemetry format such as Jaeger or Prometheus when sending data to several open-source or commercial back-ends.

The project's stated objectives are to be usable, with sensible default configuration and support for popular protocols, performant and stable under varying loads, observable itself, extensible without touching the core code, and unified, with a single codebase that can run as an agent or a collector for traces, metrics and logs. Documentation covers getting started, configuration, security and monitoring.

The Collector is written in Go, licensed under Apache-2.0 and is part of the CNCF ecosystem, with a special interest group that meets weekly. You deploy it yourself next to your applications or as a central gateway. It suits platform and SRE teams standardizing telemetry pipelines.

Grafana Alloy is an open-source distribution of the OpenTelemetry Collector with built-in Prometheus pipelines. It collects and forwards metrics, logs, traces and profiles, serving as the telemetry agent in many Grafana-based setups while staying vendor-neutral.

Its main differentiators, per the README, are programmable pipelines configured with an expression-based syntax, support for dozens of OpenTelemetry Collector components alongside new Alloy-specific components, and a big tent philosophy under which it works with other vendors and open-source databases. Topics mention Loki and Prometheus. It is written in Go.

Alloy is licensed under Apache-2.0 and you run it yourself on hosts or in Kubernetes, sending data to Grafana Cloud or any compatible back end. It suits platform and SRE teams that want one configurable collector for all telemetry signals.