A Chronosphere Telemetry Pipeline alternative

Telemetry Pipeline splits the job: pipelines run on your infrastructure, but configuration and management live in a control plane Chronosphere operates. NXLog Platform keeps both halves inside your perimeter — in your data center, in your cloud account, or hosted by us if you prefer. The architecture doesn't decide for you.

Every Telemetry Pipeline deployment is a Kubernetes workload — install it on a plain Linux server and it stands up a K3s cluster first. NXLog Platform installs on one Linux host with a bundled installer. Your SOC gets collection, storage, and search without adopting a container orchestrator to run it.

Chronosphere prices Telemetry Pipeline by throughput — the raw volume you push through it. NXLog licenses by source, flat. The endpoint that logs a hundred times its normal volume during an incident costs exactly what it did the day before.

NXLog Agent collects ETW traces, Windows Event Forwarding streams with no agent on the forwarding endpoints, Registry changes, file integrity events, and Microsoft DNS Server logs. Telemetry Pipeline's endpoint layer is Fluent Bit, whose Windows inputs read the Event Log.

A pipeline moves data; it still needs somewhere to land. Telemetry Pipeline routes to a backend you run or rent separately. NXLog Platform ships with on-premises storage and search built in — you set the retention policy, and your auditors get their year of searchable history.

NXLog Agent drops, rewrites, and de-duplicates events on the endpoint, before anything crosses the network. Whatever sits downstream — a SIEM, an observability backend, or Telemetry Pipeline itself — receives less noise and meters fewer gigabytes.

Run the whole platform — management, storage, search — in your data center or your cloud account, or have us host it. Nothing needs to reach an external control plane, so isolated and air-gapped networks are a supported deployment, not an exception request.

A source is any system, device, or application NXLog collects from — a server, a firewall, a container cluster. Pricing counts sources and nothing else: no per-GB fees, no events-per-second caps, no data volume limits. The Free plan covers up to 10 sources with the full feature set.

Windows Event Log through the modern API, ETW for the channels Event Log can't see, agentless collection over Windows Event Forwarding, Registry monitoring, file integrity monitoring, performance counters, and Microsoft DNS Server log parsing. Legacy modules still cover Windows XP, 2000, and 2003 where they survive.

Enroll agents, distribute configuration from templates, watch health, and roll out updates from one console — across Windows, Linux, macOS, and the legacy systems in the back room. Solution packs ship working pipelines for common routes, such as Windows to Microsoft Sentinel or syslog to an OpenTelemetry backend.

Filter events, rewrite fields, and convert between formats — syslog, JSON, XML, CSV, CEF, LEEF, GELF — on the endpoint, before data leaves the host. Buffer to disk through outages, compress and encrypt in transit, de-duplicate repeats. Processing downstream helps; processing at the origin is cheaper.

No rip-and-replace required. Telemetry Pipeline's documented source plugins include syslog, HTTP, and OpenTelemetry, and NXLog Agent delivers over all three. Put NXLog in front: reach the endpoints a Fluent Bit-based agent can't, cut the raw throughput its meter counts, and keep a clean exit path either way. Changing the destination later is a config edit on the agent, not a redeployment across the estate.