Tiers¶
Log Processor ships in four tiers — Basic, Essential, Advanced, and Enterprise — plus a custom Enterprise+ offering. Each tier is additive: every tier includes everything in the tier below it. Processing is entitlement-aware, with a grace period on expiry.
Feature matrix¶
| Capability | Basic | Essential | Advanced | Enterprise |
|---|---|---|---|---|
| Datalake + Athena SQL queries | ✓ | ✓ | ✓ | ✓ |
| Automated CloudWatch ingestion | ✓ | ✓ | ✓ | ✓ |
| Pattern detection — tag mode | ✓ | ✓ | ✓ | ✓ |
| Pattern detection — redact / filter / tag | — | ✓ | ✓ | ✓ |
| OpenSearch search (multi-AZ) | — | 2 nodes | 3+3 dedicated masters | 6+3 nodes |
| OpenSearch Dashboards + Subscription Editor | — | ✓ | ✓ | ✓ |
| OpenSearch snapshots | — | ✓ | ✓ | ✓ |
| S3 access logging for compliance | — | ✓ | ✓ | ✓ |
| KMS encryption (S3 + SQS + datalake) | — | ✓ | ✓ | ✓ |
| Full monitoring dashboard | — | ✓ | ✓ | ✓ |
| Enhanced CloudWatch pattern metrics | — | — | ✓ | ✓ |
| Subscription Editor Roles (RBAC) | — | — | ✓ | ✓ |
| Automated compliance / health reports | — | — | ✓ | ✓ |
| Cross-account log ingestion (accounts / AWS Organization) | — | — | — | ✓ |
| MFA default for Dashboards | — | — | — | ✓ |
| Company SSO (SAML / OIDC) | — | — | — | ✓ |
Capacity defaults by tier¶
| Setting | Basic | Essential | Advanced | Enterprise |
|---|---|---|---|---|
| Storage per node (default) | n/a | n/a | 100 GB | 500 GB |
| Throughput (concurrency) | — | — | 50 concurrent | 100 concurrent (max) |
| Datalake retention (default) | 365-day audit, 90-day app | per tier | per tier | 7-year defaults |
Node counts, instance types, volumes, and retention are configurable in your deployment profile; the values above are tier defaults.
Enterprise+¶
For large or multi-account deployments. Annual pricing, custom terms, dedicated onboarding, and an SLA — transacted via an AWS Marketplace Private Offer. Contact Perfware for details.
Changing tiers¶
- Essential → Advanced → Enterprise (and downgrades): select the tier and update the stack. Node count, instance type, and volume changes are handled in-place via OpenSearch blue/green deployment with zero downtime, typically 15–30 minutes. Feature differences activate immediately based on your Marketplace entitlement dimension.
- Basic → Essential: requires a stack delete and fresh deploy, because it adds an OpenSearch domain, VPC, and dashboards infrastructure that cannot be added to an existing Basic stack. Your OpenSearch and S3 datalake remain unaffected during any tier change.
See Pricing for the software-fee model.