🔍

Shieldlix SIEM

Petabyte-scale log search and analytics. Splunk-style pipeline search with sub-second results.

Architecture

Loading diagram...

Technology Stack

Rust
Core runtime — memory-safe, zero-cost abstractions, no garbage collector
Axum
HTTP framework — type-safe routing, tower middleware, WebSocket support
Tokio
Async runtime — work-stealing scheduler, millions of concurrent I/O operations
Quickwit
Full-text search engine — BM25 ranking, sub-second petabyte queries
ClickHouse
Columnar analytics — vectorized execution, real-time aggregations at scale
Kafka
Event streaming — durable ingestion pipeline, exactly-once semantics
Next.js 16
React 19 SSR/SSG — streaming, server components, optimistic UI
React 19
UI framework — concurrent rendering, transitions, Suspense

Core Features

🔍

SPL-Style Search

Pipeline search language with 20+ commands: dedup, timechart, eval, rex, stats, top, sort, head, and more.

📊

Dashboards & Panels

8 chart types: line, area, bar, pie, table, single value, choropleth map. Drag-and-drop layout with auto-refresh.

📤

Log Ingestion

HTTP Event Collector, Syslog, Kafka, file upload. Auto-detects sourcetypes (auth, dns, syslog, kernel, JSON).

🔧

Field Extraction

Interactive wizard: highlight text to generate regex, save to props.conf, auto-trigger background reindex.

💾

Saved Searches & Reports

Schedule searches, export to CSV/JSON, email delivery, cron-based scheduling.

📈

Timeline Histograms

Time-bucketed event visualization with configurable span intervals.

🏷️

Faceted Navigation

Field sidebar with value counts, search within facets, baseline comparison.

♾️

Infinite Scroll

Cursor-based pagination with IntersectionObserver, pause/resume, batch loading.

Supported SPL Commands

index=<name>Base search with field filters
| top <field>Top-N aggregation
| stats count by <field>Group-by aggregation
| timechart span=<N> count()Time series bucketing
| eval <expr>Computed fields (lower, upper, if, case, strftime)
| dedup <field>Remove duplicate events
| rex <pattern>Regex field extraction
| sort <field>Sort results
| where <condition>Filter results
| chart count over X by YPivot tables

How Shieldlix Compares

Feature
Shieldlix
Splunk
Elastic
MS Sentinel
Pricing
Free. No ingestion limits, no per-seat fees.
$2.65–$8/GB ingested
$0.85–$2.40/GB
$4.30–$5.59/GB
Search Language
SPL-style with 20+ piped commands
Full SPL with 200+ commands
KQL + Lucene query strings
Kusto Query Language (KQL)
Search Performance
Sub-second petabyte search via Quickwit + ClickHouse
Slow on massive datasets without tuning
Fast with proper cluster sizing
Fast with Log Analytics workspace
Architecture
Rust backend + Next.js 16 frontend. Memory-safe, GC-free
Legacy Python/C++ backend. Heavy resources
Java-based. Requires JVM tuning
Azure-native. Vendor lock-in
Detection Rules
37,000+ rules from 60+ threat families
1,700+ curated. Requires ES Premium
Pre-built + custom detection rules
Built-in + custom analytics rules
Dashboards
8 panel types. Drag-and-drop layout
Data models, pivot tables, HTML
Lens, Visualize, Dashboard apps
Azure workbooks, Power BI integration
Log Ingestion
HEC, Syslog, Kafka, file upload. Auto-sourcetype
Heavy forwarders, HF/UF agents
Beats, Logstash, Elastic Agent
Agent, Syslog, Event Hub, REST API
Field Extraction
Interactive wizard + regex builder + auto-reindex
props/transforms.conf. Manual process
Runtime fields, ingest pipelines
Parse functions in KQL queries
Data Retention
Per-index hot/warm/cold tiers via MinIO
Flexible with summary indexing
ILM policies, hot/warm/cold/frozen
Retention 30–730 days, archive to Blob
Deployment
Docker Compose + K8s. Self-hosted, no lock-in
Splunk Cloud or on-prem. Complex clusters
Elastic Cloud, self-managed, ECK
Azure-only. Full SaaS
MITRE ATT&CK
Tactic/technique tags on all rules. Coverage API
Full matrix with gap analysis
MITRE framework mapping built-in
MITRE mapping in Defender portal
Scalability
Horizontal scaling via Kafka + distributed storage
Indexer clustering. Complex to scale
Shard/replica model. Cluster management
Auto-scale within Azure subscription

Cost Comparison

Annual log ingestion costs at common volumes. Shieldlix is always free.

Daily Volume
Splunk
Elastic
MS Sentinel
Shieldlix
100 GB/day
$96,725/yr
$31,025/yr
$157,065/yr
$0
500 GB/day
$483,625/yr
$155,125/yr
$785,325/yr
$0
1 TB/day
$967,250/yr
$310,250/yr
$1,570,650/yr
$0

API Endpoints

GET/v1/events/searchSearch events with cursor pagination
GET/v1/events/totalEvent count with filters
GET/v1/events/topTop-N aggregation by field
GET/v1/events/timelineTime series histogram
POST/v1/uploadsIngest events (JSON/NDJSON)
POST/v1/propsConfigure field extraction
POST/v1/indexes/reindexBackground reindex
GET/healthHealth check

Related Products

Ready to search at petabyte scale?

Free forever. No credit card. No usage limits.

Competitors charge $2–$8/GB. Shieldlix is free.