It's even sadder that it's an ad.

It was probably a contractual obligation to lower the cost of Splunk

It's an embarrassing post, which I read like "we can't even build a commodity subsystem properly". And I think it also does not sound well for Splunk either - it's like a sign of desperation!

I believe that, it actually reads like it was written by someone at Splunk! Very little detail about what they are logging and why - it's a surprisingly poor article that is little more than a crappy ad for Splunk.

With their previous tech stack, they were dropping 90% of logs via a rate limiter. This means that if you were looking to investigate a specific incident, the logs are much more likely to not be there. That feels more "fatally flawed" than "great"

I've worked at two organisations that use Splunk at huge scale. There really is no good alternative when you get really big and want a managed service.

This.

Also, when you have bespoke log solutions and engineers leave, you end up with unsupported solutions. This may be Twitters 4th logging solution IIRC. Plenty of people know splunk. Loglens, not so much.

+many. There are plenty good Enterprise software with bad rep. You can spend a lot of engineering talent to rebuild what is already solved or just buy boring tech. Splunk by definition is boring and with Twitter scale makes sense. Twitter is not too big, its decently sized.

Loglens, there’s a word I hope to never hear again.