Elasticsearch, 하나의 플랫폼으로: 두 번째 데이터 시스템의 숨겨진 비용

Running search, analytics, metrics, logs, and vector retrieval in five systems costs more than five licenses. Here's what one platform looks like in practice. If you count the data engines in your stack, you’ll find that full-text search runs in one system, while analytics runs in a warehouse. You’ll also see that metrics live in a time series database and logs are in an aggregator. And vector retrieval sits in its own dedicated vector store. That’s five engines for five shapes of the same operational data, and the licenses are the cheapest part.

We wrote about the architecture behind consolidating those shapes in Why Elasticsearch is becoming a columnar database . This post is about the other side of the ledger. What does the split actually cost, and what does "search and analytics on one platform" mean in terms clear enough to hold up in a proof of concept? Anyone who has kept two sets of books for the same business knows where the hours go. Writing the second ledger is quick, but making the two agree is what takes the week. Each engine needs its own ingest path, so the same events get parsed and shipped twice.

That gives you two sets of failure modes and two backlogs to drain when a broker slows down. It also gives you drift: A field rename lands in one copy before the other, and for a while, the two systems disagree about the same hour of data. Reconciling that disagreement is real engineering work that rarely appears in the business case. Each engine also brings a query language, and the syntax is the small part. The cost is everything written in that language, including dashboards, alert rules, saved queries, runbooks, and the operational knowledge of the person on call this week.

Two languages means two of all of it, maintained in parallel. Then there’s correlation. You find the failing request in the log aggregator. You move to the warehouse to chart how often it happened this week and then to the metrics store to check whether the host was saturated at the time. Each of those moves is a join performed by hand, by a person under time pressure, and every one of them adds minutes to the incident. Retention compounds all of this. Each system gets its own lifecycle policy, so the cheap system ends up keeping data that the expensive one dropped weeks ago.