Please consider giving EventQL [0] a try some time! It's completely open-source and self-hostable. Still a new project though, just released this summer and still in beta.
So it's a completely different class of application than splunk or elasticsearch, and one that you have a commercial interest in. Please don't spam HN.
Sure it takes a somewhat different approach (i.e. it requires an explicit schema), but for the use case discussed in this thread it _is_ completely relevant and a comparable open-source/on-premise alternative which parent was asking about.
>> one that you have a commercial interest in
Yes, I'm involved in the EventQL project but I thought that it was obvious from the way I phrased my posting. Usually I always include a disclaimer to prevent misunderstandings but I didn't consider it necessary in this case.
>> Please don't spam HN.
I don't think pitching a (relevant) startup is against the rules or the spirit of a startup forum (https://news.ycombinator.com/newsguidelines.html)