HOT TAKE: Can Era Software bring a new Era to ServiceNow that they are hoping for?

What is in the news: ServiceNow acquires Era Software for undisclosed terms. ServiceNow acquired Lightstep last year in May (2021) and it’s strengthening its observability portfolio with this acquisition. I had a briefing from Ben Sigelman, GM, Lightstep division of ServiceNow, and Todd Persen, CEO of Era Software.

What does Era do: Era Software, which started as EraDB, is a centralized log management solution that was co-founded by Todd Persen in 2019 and based in Seattle. They connect with most open-source log collectors such as FluentBit, FluentD, and LogStash, which are predominant in cloud-native applications and offer a way to centralize logs to cheaper storage locations such as Amazon S3. They currently offer an on-premises, self-hosted solution or a SaaS version on the AWS cloud.

Why it matters: ServiceNow realized enterprises are moving to cloud-native at a much faster pace with pandemic-induced digital maturity.

When incidents happen, while metrics and tracing can help isolate the problem, logging generally is used to identify the cause of the incident quickly assuming the developers properly created logs. Especially in the cloud-native architecture, the applications are architected as microservice components. The smaller DevOps teams are responsible for smaller components and are expected to produce code velocity that can release many changes to a (micro)service on a daily basis. Given the lack of total visibility, logs become a critical component to understanding what happened inside a service if it is broken. However, cloud-native architectures also produce a ton of logs. Large enterprises can produce hundreds of terabytes of logs to even petabytes (PB) of logs per day, though PBs of logs are rare. With that volume of logs, searching, storing, analyzing, moving, and generally managing are all very expensive for large enterprises. Logs are also generally retained by enterprises for a lot longer than other observability metrics for later analysis, audit, and forensic evidence as needed. Siloed logs can lead to a different set of problems. Centralized logs, at a cheaper cost, to handle such volume is a dream come true for a lot of enterprises. Most legacy log vendors not only struggle to cope with that volume but also cost overruns can be prohibitive.

Constellation POV:

Era brings the sorely lacked log management capability to the Lightstep observability platform. While the petabyte scale search capabilities, index free, zero schema approach and low-cost object storage options such as Amazon S3 are very appealing to enterprises, Era Software is a dark horse that hasn’t been proven in the enterprise market yet. Based on my conversations with some of the CXO customer executives, and observability practitioners who have evaluated the solution recently:

1. The ServiceNow acquisition takes the issue of financial viability off the table for Era Software prospects. Having a venerable vendor such as ServiceNow behind Era Software’s capability will improve confidence and cross-sell.
2. Large enterprises already have a well-implemented log solution (even for the cloud-native logs) in place. Given how complex enterprise log management systems can get, it will not be viable for those large enterprises to rip and replace an existing solution with a newer one. Those larger log management systems themselves have become observability solutions over the years. It will be much harder for ServiceNow, even with this combined solution set, to break into those enterprises.
3. Existing log management solutions are expanding their observability solution set at a much more rapid pace than ServiceNow. While they may be lacking ServiceNow’s flagship tracing capabilities, most of them have a decent competing solution in place already.
4. Era is not a worthy full observability solution until now. Based on the roadmap plan, it will be mid-to-late 2023 before Lightstep + Era Software + ServiceNow can offer a fully baked-in, combined solution that might appeal to large enterprises for total observability. By then, a lot of them might have been deeply entrenched with other worthy competitors.
5. While Era Software offers a decent log collection capability for cloud-native, it lacks integrations with data center log collection capabilities for the hybrid enterprise.
6. The overall solution set is very narrow and focused on logs; it doesn’t offer a lot of capabilities that mature observability solutions do (when they were just Era Software). But this acquisition adds the right elements such as logs, metrics, and traces to bring the required observability signals to one platform.
7. While Era touts a lower entry point in pricing and much more value addition and much lower TCO than the famous, and very commonly used, log provider Elastic, the evaluators suggested they don’t have the capabilities that are offered by Elastic at the current time. Hence, they decided to pass.
8. Sending logs to an off-location, and cheaper storage can lead to a set of its own problems such as compliance, security, GDPR, and other privacy-based issues. How would that be handled in the combined solution? (ServiceNow stated that privacy and security are important and that Lightstep and Era Software combination will go thru this exercise to offer customers with choice and control of how their data is stored and secure, but that remains to be seen after the integration).
9. The lightweight, can-run-anywhere option is appealing – the solution can run locally and have a hot cash, or run at cloud locations as well if SaaS managed service.
10. S3 compatible storage and federated search options without moving the logs around are very appealing. But competitors, such as Splunk, introduced similar functionalities as well.
11. At the current time cost might be an appealing factor, we don’t really know how the combined pricing will look in the near future when the platform comes into shape.

Bottomline:

Digital transformation succeeds, or fails, based on observability implementation – whether it is cloud-native or hybrid. Visibility and holistic observability are foundational components of any digital application.

Because of that, the observability market is huge. Yet, when you think of observability, ServiceNow is not the first name that comes to mind. They are hoping to change that. ServiceNow acquired a decent tracing solution in Lightstep in 2021, and now acquired a decent technology that can help them bring logs into the Lightstep observability platform fold. They also promised to continue to build the functionality to appeal to large enterprises.

The competition is also heating up with all APM vendors and log management vendors adding decent wholistic observability solutions over the last few years. Is what ServiceNow doing is enough, and will they be able to build the missing pieces fast enough? Only time can tell. When the integrated Lightstep platform is ready to go, it might be worthy of consideration.

What do you think?

Further Reading:

1. Blog - News Analysis: Major Announcements From Splunk .conf22 Bring Observability and Security to the Forefront
2. Blog - Crisis/Incident Management in the Digital Era
3. Blog - In Digital Economy, You Should Fail Fast, But Must Also Recover Fast
4. Research Report - 2022 Trends in Site Reliability Engineering
5. Research Report - 2022 Trends in Incident Management
6. Research Report - Constellation ShortList™ Observability