Elasticsearch vs OpenSearch vs Loki for Log Storage 2026

# loki-values.yaml (Helm)
loki:
  auth_enabled: false
  storage:
    type: s3
    s3:
      endpoint: s3.amazonaws.com
      region: us-east-1
      bucketnames: my-loki-logs
      access_key_id: ${AWS_ACCESS_KEY_ID}
      secret_access_key: ${AWS_SECRET_ACCESS_KEY}
  schema_config:
    configs:
    - from: "2024-01-01"
      store: tsdb
      object_store: s3
      schema: v13
      index:
        prefix: loki_index_
        period: 24h
  limits_config:
    retention_period: 30d
    ingestion_rate_mb: 16
    ingestion_burst_size_mb: 32
 
promtail:
  config:
    clients:
    - url: http://loki:3100/loki/api/v1/push

helm repo add grafana https://grafana.github.io/helm-charts
helm install loki grafana/loki-stack \
  --namespace monitoring \
  --values loki-values.yaml

# opensearch-values.yaml
opensearch:
  replicas: 3
  resources:
    requests:
      memory: "2Gi"
      cpu: "1000m"
    limits:
      memory: "4Gi"
  persistence:
    size: 100Gi
  config:
    opensearch.yml: |
      cluster.name: logs-cluster
      plugins.security.disabled: false
      indices.query.bool.max_clause_count: 4096
 
opensearch-dashboards:
  enabled: true
  service:
    type: ClusterIP

helm repo add opensearch https://opensearch-project.github.io/helm-charts/
helm install opensearch opensearch/opensearch \
  --namespace logging \
  --values opensearch-values.yaml

# All error logs from a specific app in last hour
{app="payment-service", env="production"} |= "ERROR"
 
# Rate of errors per minute
rate({app="payment-service"} |= "ERROR" [1m])
 
# Parse JSON logs and filter by field
{app="api"} | json | status_code >= 500
 
# Count log lines by level
sum by (level) (count_over_time({app="api"} | json [5m]))

{
  "query": {
    "bool": {
      "must": [
        { "match": { "level": "ERROR" } },
        { "match": { "service.name": "payment-service" } }
      ],
      "filter": [
        { "range": { "@timestamp": { "gte": "now-1h" } } }
      ]
    }
  },
  "aggs": {
    "errors_over_time": {
      "date_histogram": {
        "field": "@timestamp",
        "fixed_interval": "1m"
      }
    }
  }
}

# Loki: compactor handles retention
loki:
  compactor:
    retention_enabled: true
    retention_delete_delay: 2h
    retention_delete_worker_count: 150
  limits_config:
    retention_period: 30d
    # Per-tenant override
    per_tenant_override_config: /etc/loki/overrides.yaml

# OpenSearch: ISM policy for retention
{
  "policy": {
    "description": "30-day log retention",
    "states": [
      {
        "name": "hot",
        "actions": [],
        "transitions": [
          {
            "state_name": "delete",
            "conditions": { "min_index_age": "30d" }
          }
        ]
      },
      {
        "name": "delete",
        "actions": [{ "delete": {} }]
      }
    ]
  }
}