Freedom251 › Log Management Software
Purl
What Purl is
Purl is lightweight, self-hosted software for aggregating, searching, and analyzing infrastructure logs. It provides log pipelines, live tailing, structured parsing, and KQL-style search with autocomplete, Boolean operators, wildcards, facets, time histograms, and saved searches. Automatic clustering groups logs into patterns and reports occurrence counts. A real-time dashboard covers health, query performance, ingestion, latency percentiles, and storage metrics. Purl supports Kubernetes DaemonSet deployment, Docker, containerd, and Kubernetes labels, while its Vector-based agent collects logs from /var/log/, systemd journal, and Docker containers. The server, ClickHouse database, and dashboard run on infrastructure the customer controls, and logs are not sent to purlogs.com. A free plan includes unlimited servers, agents, users, alert rules, and saved searches, with retention limited by customer storage. Pro costs $39.00 per month; Enterprise costs $199.00 per month.
Who it suits
Purl suits teams that want self-hosted log management and control of log data, from basic collection and search to Kubernetes monitoring and enterprise identity features.
What it does well
- Self-hosted infrastructure and data control
- Live log tailing and structured parsing
- KQL-style search with saved searches
- Automatic log pattern clustering
- Free plan with unlimited servers and agents
What to know first
- Retention depends on customer storage
- No SOC 2 or ISO 27001 certification
- No HIPAA BAA
- Rate limit of 1,000 API requests per minute
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free | Unlimited servers & agents · Unlimited users · Unlimited alert rules · Unlimited saved searches · Retention limited only by your own storage · Community support | Free |
| Pro | Monthly · Everything in Free · Custom dashboards · AI query assistant and log analysis · Ingest pipelines · Backup & restore · Elasticsearch-compatible API · Kubernetes monitoring · Webhook alerts · Priority email support · 1 license activation per key | $39 a month |
| Enterprise | Monthly · Everything in Pro · SSO / SAML 2.0 · LDAP / Active Directory · Audit logs & compliance · Dedicated support engineer · 1 license activation per key | $199 a month |
As purlogs.com lists them, read 8 Oct 2026. The maker's own page has the final word.
Verdict
Purl provides broad log collection, search, analysis, and alerting while keeping deployment and data on customer-controlled infrastructure. Paid tiers add dashboards, AI assistance, integrations, monitoring, and identity controls, but stated compliance limitations remain.
Facts from Purl's own pages
- Alert integrations
- The Free plan includes Telegram and Slack alerts; Pro adds webhook alerts. · purlogs.com, 8 Oct 2026
- Analytics
- The analytics dashboard reports health, query performance, ingestion, latency percentiles and storage metrics in real time. · purlogs.com, 8 Oct 2026
- API and limits
- The installation guide documents API key authentication and rate limiting at 1,000 requests per minute. · purlogs.com, 8 Oct 2026
- Authentication
- Log ingestion uses customer-configured API keys, while dashboard users authenticate with server-side session cookies. · purlogs.com, 8 Oct 2026
- Compliance limits
- Purl states it is not SOC 2 or ISO 27001 certified, has no HIPAA BAA, and has no third-party penetration test or bug bounty programme. · purlogs.com, 8 Oct 2026
- Container support
- Purl supports Kubernetes DaemonSet deployment, automatic pod and container metadata, Docker, containerd, and Kubernetes labels. · purlogs.com, 8 Oct 2026
- Deployment options
- self-hosted · purlogs.com, 23 Sept 2026
- Deployment requirements
- The installation guide lists Linux server requirements of Ubuntu 20.04+, Debian 11+ or CentOS 8+, with at least 512 MB RAM and one CPU core. · purlogs.com, 8 Oct 2026
- Enterprise identity
- SSO / SAML 2.0 and LDAP / Active Directory are Enterprise features. · purlogs.com, 8 Oct 2026
- Free plan
- Yes · purlogs.com, 23 Sept 2026
- Free-plan limits
- The Free plan has unlimited servers, agents, users, alert rules and saved searches, while log retention is limited by the customer's own storage. · purlogs.com, 8 Oct 2026
- Live log tailing
- Yes · purlogs.com, 23 Sept 2026
- Log collection
- The Vector-based agent collects logs from /var/log/, systemd journal and Docker containers and ships them to the Purl server. · purlogs.com, 8 Oct 2026
- Log pipelines
- Yes · purlogs.com, 23 Sept 2026
- Pattern analysis
- Purl automatically clusters logs into patterns using typed placeholders and reports occurrence counts. · purlogs.com, 8 Oct 2026
- Product
- Purl is lightweight, self-hosted log aggregation for searching and analyzing infrastructure logs. · purlogs.com, 8 Oct 2026
- Search
- Its KQL-style search supports field autocomplete, boolean operators, wildcards, facets, time histograms and saved searches. · purlogs.com, 8 Oct 2026
- Self-hosting and data
- The Purl server, ClickHouse database and dashboard run on infrastructure the customer controls, and log data is not transmitted to purlogs.com. · purlogs.com, 8 Oct 2026
- Paid from
- 39 · purlogs.com, 23 Sept 2026
- Structured log parsing
- Yes · purlogs.com, 23 Sept 2026
Where Purl stands on Freedom251
- Log Management Software#32 of 111