Glossary
Log aggregation
Collecting log data from many separate systems into one centralized, searchable store instead of checking each system individually.
Also called: centralized logging, log management
Log aggregation is the practice of collecting log data from many separate systems, servers, applications, containers, network devices, into one centralized, searchable store, rather than leaving engineers to check logs on each system individually. Aggregated logs are typically parsed into a structured format and indexed so they can be searched and filtered quickly during an investigation.
Log aggregation differs from a full SIEM in that it centralizes and makes logs searchable but does not necessarily add security-specific correlation rules, threat detection content, or case management on top; a SIEM is often built on an aggregation layer with those capabilities added. It also underpins application performance monitoring and distributed tracing workflows, where logs are one of several correlated data types alongside traces and metrics.
Log aggregation matters because without it, diagnosing an issue that spans multiple systems means manually checking each one, which does not scale past a handful of services. A common pitfall is aggregating logs without a retention and cost strategy: verbose, unfiltered logging at high volume drives storage and licensing costs up quickly and can create a metric cardinality-like explosion in structured log fields.
Last reviewed September 22, 2026