Coralogix vs Google Cloud Operations: Support, Pricing and Features

Google Cloud Operations, formerly known as Stackdriver, is relatively new to the observability space. That being said, its position in the GCP ecosystem makes the platform a serious contender.

Let’s explore some of the key ways in which Google Cloud Operations differs from Coralogix, a strong full-stack observability platform and leader in providing in-stream log analysis for logs, metrics, tracing and security data.

Coralogix vs. Google Cloud Operations

Logs, metrics, traces

Both Coralogix and GCP offer support for logs, metrics and traces. Both solutions also support direct integrations into OpenTelemetry, enabling customers to integrate in an open-source fashion, and avoid vendor lock-in.

There is a great deal of difference in alerting with Coralogix vs Google Cloud Operations.

Log-based alerting

While GCP supports alerting on logs to detect specific fields that appear in logs, the platform is limited to only this type of alerting capability. Notably, Google Cloud Operations do not support alerts that involve counting a set of logs that match a given query.

In comparison, Coralogix offers six different types of alerts—from simple log count to ratio and time relative alerts—with log alerting that is one of the most sophisticated options on the market. Our platform enables highly sophisticated insight generation.

Coralogix also supports the “more than usual” and “less than usual” dynamic alert conditions, driven by a machine-learning algorithm to detect anomalous data flow patterns in customer data. Coralogix alerts enable the detection of “unknown-unknowns” and act as a safety blanket to catch issues that may otherwise go undetected. 

Alerting on traces

Google only supports alerting on traces in specific circumstances, like detecting changes in ingest rate. Thus limits the ability of the customer to detect important changes in the latency and performance of their system.

Coralogix supports alerting on traces and allows for alerts to track down specific interactions between applications and even individual endpoints. Therefore, Coralogix alerts give a voice to the wealth of information hidden within traces that often go unnoticed.

Data correlation and usability 

Google Cloud Operations separates data types out into different services, and encourages customers to access different values in different interfaces. If they wish to overcome this limitation, they have to make an up-front effort to build dashboards at cost.

Coralogix, on the other hand, seamlessly blends data together in a single, rapid troubleshooting experience, which reduce Mean Time To Diagnosis (MTTD) and accelerates recovery. 

Coralogix flow alerts

Coralogix alerting has unique features like Coralogix Flow Alerts, which allow users to orchestrate their logs, metrics, traces, and security data into a single alert that tracks multiple events over time. Using Flow Alerts, customers can track the change in their system.

Machine-learning capabilities 

Google Cloud has machine learning driven anomaly detection in some of its services, but this is not a configurable part of the platform. On the other hand, Coralogix supports anomaly detection out of the box, with dynamic alerting.  

Coralogix Loggregation, another dimension of AIOps

Coralogix Loggregation is a unique feature in the Coralogix toolkit. Loggregation will automatically cluster similar logs together, to form a “template.” This functionality allows users to understand which logs are noisiest and accounting for the most errors and more.

Google Cloud does not offer a competitive alternative to this feature, and suffers from the same problems that traditional systems do when dealing with large volumes of data. 

Archiving and Archive Query

Google Cloud does offer a basic archiving solution, but it doesn’t have much functionality around it. Conversely, all Coralogix customers, regardless of ingestion amounts, can remotely archive their data into cloud object storage.

Since Coralogix does not tier its solution, customers who ingest their data into the platform gain immediate access to every single feature. With the Coralogix platform, you can also perform remote queries in seconds on archived, unindexed data.

Google Cloud does not offer this feature, and instead relies on its customers to perform the necessary engineering work to join together Amazon Athena, AWS S3 and more. All of this comes at an added cost. 

Cost optimization

Coralogix users start by indexing the majority of their data, but over time, they tend to transfer more data to the archive because data can be queried in seconds, at no extra cost. This functionality means customers can store the majority of their data in S3, and pay at most $0.004 / GB for storage.

Coupled with the Compliance ingest costs in Coralogix, $0.17 / GB, the GB cost for ingest and storage is $0.174 / GB for the first month. By contrast, Google Cloud advises customers to delete unused resources to save cost. While deleting is a standard practice across all tools, it is an indication of how little automated support there is for lowering monthly operational cost for observability data.

Coralogix doesn’t charge by cloud resources, but by ingestion volume. More than that, Coralogix allows customers to assign use cases to traces and logs, which drive instant cost savings via the TCO Optimizer. These decisions are flexible and reversible, and entirely risk free. 

Converting logs, traces to metrics

Another typical cost optimization strategy is to convert more expensive data types, like logs and traces, into metrics that can be retained for a long period of time without incurring additional cost.

Google Cloud supports log-based metrics, which enables customers to generate metric data from information available in their logs. Coralogix also supports this functionality, however with one key distinction. Coralogix Logs2Metrics do not cost anything extra. Google Cloud log-based metrics are considered “chargeable metrics” and come at an additional cost.

Google Cloud does not support converting Traces into metrics at all. Coralogix, on the other hand, allows customers to convert all of their traces into metrics that can be retained for as long as they like (default of 1 year), for a fraction of the cost. 

Pricing model

The Coralogix pricing model is based entirely on GB ingested with no solution tiering or extra costs for features, making it easy for new customers to predict their costs. In comparison, the Google Cloud offering is based on a different price per service and data type, meaning it’s going to be very difficult to work out precisely how much you will spend. 

Customer support 

Google Cloud support for outages and incidents comes in three tiers. Standard, enhanced and premium. 

  • Standard support comes at an additional cost of $29 / month and only operates within local business hours. Additionally, it only offers support for P2 severity issues and aims to respond within four hours. 
  • Enhanced support costs $500 / month and aims to respond to P1 incidents within one hour.
  • Premium Support costs $12,500 / month and aims to respond to P1 incidents within 15 minutes.

By contrast, Coralogix offers all customers a median 30-second response time, an SLA measured in minutes, and 24/7 support. Coralogix also offers a median resolution time of 43 minutes. It does all of this at no extra cost. The closest comparable response times between Google Cloud and Coralogix is their Premium support package, representing a huge $12,500 / month saving

Out-of-the-box dashboards

Google was the original author of Kubernetes, so their in-house Kubernetes monitoring is great, although it only offers the basic assessment of a cluster, like the number of nodes or amount of pods. 

Coralogix has pre-built dashboards for Kubernetes Monitoring, Serverless monitoring and more, while also supporting open source dashboarding solutions like Grafana. Coralogix also provides a custom dashboarding solution for Coralogix users. These dashboards help with everything from resilience to cost-optimization use cases.

The platform’s reuse of open source dashboards, like JSON definitions for Grafana, and the time-to-value of premade dashboards makes its offerings the best of both worlds, while charging absolutely nothing extra for their use.

A simple comparison

Let’s define a simple use case, to highlight the difference in cost between Google Cloud and Coralogix. Let’s say we have a customer who ingests 1TB each of logs, metrics and traces with a one month retention. How much will they pay in that one month?

According to the Google Cloud calculator, it will cost them roughly $694 to ingest and hold onto that data for a single month. However, this cost does not factor in support, along with any of the additional costs associated with using the Google Cloud platform. 

Let’s be generous and assume no additional costs, but we are forced to include the cost of their Premium Support, because this is the closest product that Google Cloud offers to the Coralogix support model that comes as standard. This brings their total costs to $13,194.

Coralogix does not charge anything extra for support or feature usage. The only cost a customer pays is for the data they use, and nothing more. This means the monthly cost for 1GB of Logs, metrics & traces comes to $1,405. This comes with full support and access to every feature in the Coralogix platform, at no extra cost. 

While Google Cloud Operations enjoys tight integrations into all major Google Cloud services, its poor user experience, lack of feature depth, missing archive features, complex pricing model and lack of effective cost-optimization means it falls behind when compared to the features available in the Coralogix platform.

Exciting New Features of Coralogix STA

We at Coralogix, believe that cloud security is not a “nice-to-have” feature – something that only large organizations can benefit from or are entitled to have. We believe it’s a basic need that should be solved for organizations of any shape and size. This is why we built the Coralogix Security Traffic Analyzer (STA) tool for packet sniffing and automated analysis. Today we’re announcing several new features to our security product you’ll find interesting.

1. Automatic AWS VPC Traffic Mirroring Configuration Manager

One of the great things about AWS is that everything can scale up and down as much as needed to keep costs at a minimum while not losing any important data. Now we brought this power to the VPC Traffic Mirroring configuration. You can read all about it here.

2. Spot/On-demand Choice

The new installation process of the STA now allows you to choose whether you’d like to run the STA as a spot instance of a spot fleet (for example for testing purposes) or as an on-demand instance. Now the choice is absolutely yours.

3. Configurable Size

Now you can choose the size of the machine that will be used for the STA.  The instance types that are going to be used based on the selected size are listed below:
[table id=40 /]

4. Automated configuration sync to S3

During installation, you can set an S3 bucket for the configuration of the STA, if the bucket is empty, the STA will automatically copy its config files to that bucket, if the bucket contains the STA config files and they have been modified (either manually by you or by a script…) the STA will automatically pull the new configuration and apply it. This configuration includes the following files:
[table id=41 /]
To learn more about how to modify these files see here.

5. Automated upload of .pcap files to S3

During installation, the user can set an S3 bucket that will be used by the STA to upload compressed pcap files of all the traffic that was observed by the STA. The user can then set any lifecycle hook on that bucket for automated cleanup of old pcap files. This bucket will also contain executable files extracted directly from the traffic. These pcap files can be used for many purposes, including forensic investigations, alert tuneups, deeper investigations of applications and services issues, and more.

6. Monitoring

The new STA contains a built-in Prometheus node-exporter that listens on the third network interface on the default port.

7. Domain letter frequency analysis

Many cyber attacks nowadays are using command and control servers, and kill-switches for their malicious code. These usually use machine-generated domain names. We added a new capability to the STA to automatically calculate a score for each domain, parent domain virtual host, certificate CN, etc. based on the frequency of letter combinations that are expected to be rare and letter combinations that are expected to be frequent. This score can be used to detect machine-generated domains in certificates, common names, and DNS requests, and several other locations where the domain name can be found.

8. “Baby Domains”

Employees and even more so, servers that are accessing domains that are “young” in the sense that they were registered only very recently are often good indications of malicious activity. The new version of the STA automatically pulls a list of domains with their creation date and adds the creation date to every domain detected in DNS requests, virtual hosts, and many other fields that contain a domain name. In addition, the new version of the STA contains a special dashboard for displaying such “baby domains” that were accessed by monitored servers and clients.

9. NIST Enrichment

The STA will automatically attempt to detect the software and version on the client and server machines that took part in the communications seen by the STA. Based on that information, the STA will attempt to detect CVEs (Common Vulnerability Enumeration) numbers associated with that software by MITRE and will alert you if a new type of software is found or if a new vulnerable software was detected.

10. Default Alerts

We added a default set of more than 60 alerts that will be added to your account after the installation of the STA. These alerts will help you to get started with the STA and dramatically improve your organization’s security posture. You can read more about these alerts here.

11. Default Dashboards

We added a default set of more than 60 different dashboards to help you slice and dice the data to find your needle in the huge haystack

That’s it for now. We have lots of new exciting features just waiting to be released in the next versions so stay tuned.