Elasticsearch vs. PRTG Network Monitor

Elasticsearch is a really scalable solution that can fit a lot of needs, but the bigger and/or those needs become, the more understanding & infrastructure you will need for your instance to be running correctly. Elasticsearch is not problem-free - you can get yourself in a lot of trouble if you are not following good practices and/or if are not managing the cluster correctly. Licensing is a big decision point here as Elasticsearch is a middleware component - be sure to read the licensing agreement of the version you want to try before you commit to it. Same goes for long-term support - be sure to keep yourself in the know for this aspect you may end up stuck with an unpatched version for years.

Incentivized

integrates seamlessly with Windows servers via WMI and PowerShell, providing deep insights into resource usage, performance metrics, and system health. It's excellent at tracking CPU, memory, disk space, and event logs, enabling rapid troubleshooting and proactive maintenance. PRTG Network Monitor also effectively monitors Fortigate devices, providing detailed data on firewall health, traffic patterns, bandwidth utilization, VPN status, and security alerts. This visibility helps detect and resolve network security issues promptly.

Incentivized

• As I mentioned before, Elasticsearch's flexible data model is unparalleled. You can nest fields as deeply as you want, have as many fields as you want, but whatever you want in those fields (as long as it stays the same type), and all of it will be searchable and you don't need to even declare a schema beforehand!
• Elastic, the company behind Elasticsearch, is super strong financially and they have a great team of devs and product managers working on Elasticsearch. When I first started using ES 3 years ago, I was 90% impressed and knew it would be a good fit. 3 years later, I am 200% impressed and blown away by how far it has come and gotten even better. If there are features that are missing or you don't think it's fast enough right now, I bet it'll be suitable next year because the team behind it is so dang fast!
• Elasticsearch is really, really stable. It takes a lot to bring down a cluster. It's self-balancing algorithms, leader-election system, self-healing properties are state of the art. We've never seen network failures or hard-drive corruption or CPU bugs bring down an ES cluster.

Incentivized

• Switch monitoring and finding out if there are communication issues or throughput alerts are reached
• Big picture view of the whole infrastructure and what is functioning and what is not
• Uptime tracking is great and lets us know for how long a device is down or overall uptime

Incentivized

• Joining data requires duplicate de-normalized documents that make parent child relationships. It is hard and requires a lot of synchronizations
• Tracking errors in the data in the logs can be hard, and sometimes recurring errors blow up the error logs
• Schema changes require complete reindexing of an index

Incentivized

• Licensing on a per entity basis can be cumbersome for devices which have a ton of monitoring points like network switches\routers. Each sensor may count against a license, which could be a lot of you were monitoring every TX\RX of an SFP for example
• A better method to easily template\copy monitors across devices
• The navigation in the web GUI could be a little more straightforward in terms of the hierarchy

Incentivized

We're pretty heavily invested in ElasticSearch at this point, and there aren't any obvious negatives that would make us reconsider this decision.

Incentivized

I would renew it because the platform has brought us many technical and economic benefits that make the cost-benefit ratio very good. Additionally, to do so does not require large investments in training, licensing or infrastructure, and at the administration level, extensive knowledge is not required to be able to bear it.

Incentivized

To get started with Elasticsearch, you don't have to get very involved in configuring what really is an incredibly complex system under the hood. You simply install the package, run the service, and you're immediately able to begin using it. You don't need to learn any sort of query language to add data to Elasticsearch or perform some basic searching. If you're used to any sort of RESTful API, getting started with Elasticsearch is a breeze. If you've never interacted with a RESTful API directly, the journey may be a little more bumpy. Overall, though, it's incredibly simple to use for what it's doing under the covers.

Incentivized

The tool is very intuitive to use and it is Windows-based (everybody knows how to use Windows) so it's easy to get into. Every time is setup in a hierarchy so if you have a good initial hierarchy design, it will really reduce administrative effort down the road.

Incentivized

We've only used it as an opensource tooling. We did not purchase any additional support to roll out the elasticsearch software. When rolling out the application on our platform we've used the documentation which was available online. During our test phases we did not experience any bugs or issues so we did not rely on support at all.

Incentivized

PRTG does everything we need it to do and more. Ease of use, ease of management and maintenance and clarity of monitoring of hundreds of different types of device and service gives this a large advantage over other products on the market that I have tried. I would definitely recommend it to anyone who needs a network monitoring product in their environment and even to people who don't know they need a solution yet!

Incentivized

Do not mix data and master roles. Dedicate at least 3 nodes just for Master

Incentivized

It's very important that de project's teams have different member of the TI. We have learned too late the importa of Security Analyst at the design architecture moment. We have to rebuild part of the implementation for made this big mistake.

Incentivized

As far as we are concerned, Elasticsearch is the gold standard and we have barely evaluated any alternatives. You could consider it an alternative to a relational or NoSQL database, so in cases where those suffice, you don't need Elasticsearch. But if you want powerful text-based search capabilities across large data sets, Elasticsearch is the way to go.

Incentivized

PRTG offers more versatility in monitoring when compared to the other solutions we tested. The other solutions were also limited as far as customization options, which made them less adaptable to our networks. When compared to Auvik, for instance, we prefer PRTG as it offers immediate notifications through the desktop client - not limited to email notifications as with Auvik. We also appreciate the fact that PRTG can be self/on-prem hosted vs Auvik's cloud model. This makes for an easier deployment and less firewall adjustments to allow traffic to cloud-hosted solutions.

Incentivized

• We have had great luck with implementing Elasticsearch for our search and analytics use cases.
• While the operational burden is not minimal, operating a cluster of servers, using a custom query language, writing Elasticsearch-specific bulk insert code, the performance and the relative operational ease of Elasticsearch are unparalleled.
• We've easily saved hundreds of thousands of dollars implementing Elasticsearch vs. RDBMS vs. other no-SQL solutions for our specific set of problems.

Incentivized

• The ability to analyze multiple pieces of information in one place, especially with historical data, has saved our IT department time and headaches. It would be so much more difficult to trace an issue without PRTG, just relying on event logs and an open task manager window.
• The cost is not cheap, so it's an expense that hits the bottom line like everything else. Figure in hardware costs as well, ideally a server outside of your main environment.
• I keep saying this, but the historical data piece is worth so much. There's really no good way to collect all of that information in one place without something like PRTG. And that definitely saves time and money in the long run.

Incentivized