METRICKEEPER
Get Early Access //
← Back to Archive
// Cost Comparison2026-08-256 min read

ELK Stack for Cloudflare Logs: The Hidden Operations Cost

The ELK stack (Elasticsearch, Logstash, Kibana) looks like the budget-friendly way to search Cloudflare logs: open-source, self-hosted, no per-event fees.

The license is free. Running it isn’t.

Prerequisite: raw logs mean Enterprise

To put Cloudflare request logs in Elasticsearch, you need them delivered by Logpush, which is Enterprise-only. Without Enterprise, there are no raw logs to index. See what non-Enterprise plans get instead.

The pipeline

  1. Logpush sends logs to S3, R2, or an HTTP endpoint
  2. Logstash or Elastic Agent reads, parses, and ships them (Elastic has a Cloudflare Logpush integration)
  3. Elasticsearch indexes them into daily or rollover indices
  4. Index Lifecycle Management (ILM) moves data hot → warm → cold → delete
  5. Kibana for searches and dashboards

What you’re signing up to operate

Disk, and a lot of it

Elasticsearch stores the data plus its index structures, and each replica stores it again. As a rough planning rule, budget at least your raw log size times (1 + replicas), then measure.

At 1 billion requests per month (~1 TB raw) with one replica, a year of searchable history means tens of terabytes of disk across your cluster.

Shards and mappings

  • Too many small shards waste heap; too few large ones make recovery slow
  • Cloudflare log fields need explicit mappings (IPs as ip, timestamps as date, paths as keyword) or searches and aggregations misbehave
  • New Logpush fields mean mapping updates

Memory and stability

  • JVM heap sizing, garbage collection pauses, circuit breakers
  • A heavy Kibana query during an incident can push a small cluster over
  • Node failures mean shard reallocation, often exactly when you’re busiest

Upgrades and security

  • Major-version upgrades need rolling restarts and compatibility checks
  • TLS, authentication, and access control need configuring and maintaining
  • An exposed Elasticsearch cluster is a classic data-breach headline

The pattern: ELK starts as a weekend project and becomes a part-time job. For many teams it ends up as one engineer’s permanent side responsibility.

Managed options

Elastic Cloud or Amazon OpenSearch Service take over upgrades and node failures, but you pay for the provisioned capacity, and you still own mappings, ILM, and capacity planning.

When ELK is a good fit

  • You’re on Cloudflare Enterprise with raw logs
  • You already run Elasticsearch for application logs and have the expertise
  • You need full-text search over request details and want it self-hosted

When it’s the wrong tool

  • Nobody on the team wants to be the Elasticsearch on-call
  • What you need is history and trends, not a search engine
  • You’re not on Enterprise

Compare with S3 + Athena, which is cheaper to run but slower to query, and with Datadog, which is fully managed but priced per event.

No cluster required

MetricKeeper keeps your Cloudflare analytics history without a cluster to run. Connect a read-only token, choose your zones, and get a searchable timeline with nothing to patch.

Get Early Access →

Sources