Hydrolix

Editor’s note: This Hydrolix review is based on my hands-on evaluation of Hydrolix v6.4 (Hydrolix Cloud and the self-managed platform) in October 2026. I weighed pricing, onboarding, ingest and retention, query access, deployment, security and rivals.

Quick verdict: I recommend Hydrolix for media, streaming and security teams that keep terabytes of logs a day and want months of them queryable at a per-GB price, especially on AWS or Akamai. The trade-off: it is append-only, every query needs a time filter, and anything beyond the North America AWS list price is quoted.

Hydrolix separates stateless compute from object storage, indexes every column by default, and bills $0.31 per GB ingested on Hydrolix Cloud with three months of retention and queries included.

In this review, I’ll take a closer look at Hydrolix’s pricing, features, and query tools, so you can see exactly whether it fits your log workload.

Key Takeaways:

• Hydrolix Cloud costs $0.31 per GB ingested on North America AWS, three months of retention included
• BYOC starts at $0.20 per GB for teams ingesting 1+ TB a day, through sales
• ClickHouse SQL, Grafana, Kibana Gateway, Splunk and MCP query one copy of the data
• Append-only storage, mandatory timestamp filters and SELECT-only Query API access rule out general BI
• Other clouds and regions, longer retention and Akamai TrafficPeak are quote-only

Pros and Cons

How Much Does Hydrolix Cost?

Hydrolix bills per GB ingested on both deployment options, with no per-node, per-seat or per-query price. Only the infrastructure bill differs:

• Hydrolix Cloud ($0.31 per GB ingested): Fully managed SaaS with streaming ingest, three months of retention and queries included. The list price covers North America AWS; other clouds, regions and longer retention are quoted.
• BYOC (from $0.20 per GB ingested): Self-managed in your own cloud account, positioned for teams ingesting 1+ TB a day. The rate covers ingest and queries, you pay your own Kubernetes compute and object storage, and you buy through sales.
• Akamai TrafficPeak (contact for pricing): Hydrolix as a managed observability service on Akamai Connected Cloud, with 15 months of full-fidelity data by default and no separate cloud account.
• Support for Hydrolix for AWS: Standard is included; Premium costs $2,500 per month and Enterprise $5,000 per month plus 10% of average monthly spend.

Option	Price	Retention included	Who pays the infrastructure	How to buy
Hydrolix Cloud	$0.31/GB ingested (North America AWS)	3 months	Included in the rate	AWS Marketplace or sales
BYOC	From $0.20/GB ingested	Set per table; storage on your bill	You	Sales
TrafficPeak	Quoted	15 months by default	Included (Akamai Connected Cloud)	Sales
Premium support	$2,500/month	Not applicable	Not applicable	Support upgrade
Enterprise support	$5,000/month + 10% of average monthly spend	Not applicable	Not applicable	Support upgrade

At 1 TB a day for 30 days (decimal units), Hydrolix Cloud comes to 30,000 GB x $0.31, or about $9,300 a month with three months of retention. BYOC at the same volume starts around $6,000 a month in Hydrolix fees, before your own compute and storage bill.

Free-trial terms depend on the offer:

• Managed POC: A zero-charge license for the term of the POC, with a dedicated Slack channel.
• Self-managed trial on AWS Marketplace: 30 days.
• Hydrolix Cloud on AWS Marketplace: 7 days.

Confirm at signup which offer you are on, because the 30-day and 7-day terms belong to different products. AWS Marketplace purchases bill through your AWS account and draw down existing committed spend. The availability SLA pays invoice credits from 1% to 50% depending on monthly availability, claimed through a support ticket within 30 days.

Grafana Cloud Logs Pro charges $0.40 per GB written, plus $0.05 per GB processed and $0.10 per GB retained, after a $19 monthly fee covering 50 GB, with 30-day retention. Imply Polaris charges $0.35 per GB for the first TB ingested, plus a plan fee. Neither rate bundles retention and queries the way Hydrolix does, so billing units differ and neither names an overall price winner.

Is Hydrolix Good Value for Money?

• Good fit: High-volume logs kept for months, ideally funded from an AWS commit.
• Less convincing fit: Volumes well under the 1 TB a day BYOC threshold, data that needs frequent updates, and non-AWS regions without a firm quote.
• Budget priority: Price extended retention, support and, on BYOC, compute and storage before signing; the $0.20 rate is not the full bill.

Reviewer’s Notes: I recommend starting on Hydrolix Cloud with the managed POC or the Marketplace trial. Move to BYOC once you pass 1 TB a day and already run Kubernetes capacity on AWS, GCP or Azure. Budget Premium support at $2,500 a month only if these logs feed an on-call workflow, since Standard’s P1 response is 8 business hours.

My Experience With Hydrolix

The fastest way into Hydrolix Cloud is AWS Marketplace or a sales-led POC; ClickHouse Cloud, by contrast, starts self-serve with $300 in trial credits and no card. I took the Marketplace route, then built a project, table and transform by hand.

Signing Up Through AWS Marketplace

I subscribed to Hydrolix in AWS Marketplace and entered business contact details on the Hydrolix setup page. The next step was a CloudFormation stack that grants Hydrolix access to S3, Kinesis, DynamoDB and Firehose in my AWS account. Applying it creates four resources:

1. An S3 bucket for processed logs
2. A Kinesis stream for CloudFront real-time logs
3. A DynamoDB table for Kinesis checkpoints
4. A Firehose stream for WAF logs

After I clicked Verify Access, provisioning of roles, credentials and Grafana takes about four minutes. I then picked a data source and transport, Hydrolix configured both sides and sent a synthetic test event, and I pasted the stream name into the CloudFront logging settings before opening the preconfigured Grafana dashboard.

BYOC on AWS swaps the stack for an IAM policy and a cross-account role. You email the role ARN and target region to Hydrolix Support, who deploy the cluster, so clear that cross-account access with your security team first.

Creating a Project, Table and Transform

Every Hydrolix dataset hangs off a project, a table and a transform, and I created them through the Config API in this order:

1. Log in at /config/v2/login/ for a bearer token, valid for 24 hours by default.
2. Read the organization and customer IDs from /config/v2/users/current/.
3. Create a project at /config/v2/projects/, then a table at /config/v2/tables/.
4. Create a transform at /config/v2/transforms/ that maps each incoming field to a typed column and marks the primary timestamp.
5. Wait about a minute for ingest services to load the config, then post data to /ingest/event with the X-Hdx-Table and X-Hdx-Transform headers.

Version 6.4 makes a customer mandatory on every project, and the project-to-customer assignment can no longer be changed afterward. I picked the customer before creating anything, since fixing it later means a new project.

Running My First Queries

My first query was a time-bounded count through the Query API; the Hydrolix UI and the bundled Grafana run the same ClickHouse SQL. New data is ready to query about a minute after it is sent.

SELECT count()
FROM my_project.cdn_logs
WHERE timestamp > now() - INTERVAL 1 HOUR

Every query must filter on the table’s primary timestamp in the WHERE clause, and an admin can enforce that rule cluster-wide. The Query API accepts SELECT only (plus exists and describe), so table changes go through the Config API and data goes in through the ingest endpoints.

Reviewer’s Notes: Design the transform before connecting production logs, because the primary timestamp drives partitioning, retention and every query. Streaming ingest also rejects rows older than 365 days by default, so a historical backfill needs cold_data_max_age_days raised on the table first.

Ingest, Storage and Retention for High-Volume Logs

Hydrolix writes data as time-based partitions in its HDX format on S3, Google Cloud Storage or Azure Blob, each holding a manifest, an index and the data file. A Postgres catalog keeps partition metadata and ingest job state, so every other component stays stateless.

Hydrolix accepts streaming, batch and packaged CDN sources:

• Streaming: The HTTP Stream API through intake heads, Kafka, Kinesis, Google Pub/Sub, Azure Event Hubs, Amazon Data Firehose and OpenTelemetry.
• Batch: API or UI loads, plus auto-ingest triggered by bucket notifications.
• Formats: JSON, CSV/TSV and Parquet.
• Ready-made integrations: 18, including Akamai DataStream, Cloudflare, Fastly, Cribl, Fluent Bit, Vector and Logstash, with CloudFront covered by the Marketplace onboarding.

Hydrolix puts its footprint at about 55 GB stored per 1 TB of raw data while indexing every column by default. I treat that as Hydrolix’s average, not a ratio to size storage on before loading my own logs.

The merge service keeps combining small partitions into larger ones. v6.2 added partition Bloom filters and local data caching, and v6.3 added Adaptive Indexing (off by default), which swaps dictionary indexes for Bloom filters on high-cardinality string columns.

Keeping Raw Logs and Summaries

Summary tables aggregate at ingest with a SQL transform, so summaries can outlive the raw events. The limits are no window functions, no NOW(), no sharding, no calculated columns and no dictionaries.

Setting	Default	Effect
age.max_age_days	0	Keeps data indefinitely until configured otherwise
reaper.max_age_days	1	Days a deactivated partition waits before physical deletion
cold_data_max_age_days	365	Rejects older rows during streaming ingest
hot_data_max_age_minutes	60	Defines the hot-data ingest window

Retention runs off the primary timestamp, not ingest time, and time-based partitioning can keep some rows up to 24 hours past the configured age. On Hydrolix Cloud, anything past the three included months is a quote item whatever the table setting says. Grafana Cloud Logs Pro stops at 30 days, and longer retention there needs Enterprise from $25,000 a year.

ALTER TABLE UPDATE and DELETE run as heavy asynchronous jobs over a time range, and changed partitions stay invisible until the job is committed. I keep them for exceptional corrections, not routine edits.

Best for: Time-filtered investigations across months of immutable logs. Skip if: Your workload depends on frequent updates or general-purpose relational reporting.

Querying Hydrolix: SQL, Grafana, Kibana, Splunk and MCP

Hydrolix runs the ClickHouse SQL parser, so most ClickHouse SELECT syntax works, and it exposes an HTTP Query API, ClickHouse native and HTTP interfaces, the MySQL protocol, a JDBC driver and a Python driver. Query heads hand partition ranges to stateless query peer pools that can scale to zero, and query head pools (v5.11) keep admin, analyst and monitoring workloads apart on one copy of the data.

Five SQL limits shape every query:

• SELECT only through the Query API.
• A primary-timestamp filter in every WHERE clause.
• No distributed subqueries.
• JOINs across tables and projects only with matching column types, an alias on each table and a timestamp on both sides.
• Division by zero returns null instead of infinity or NaN.

Dashboard and Notebook Connections

Grafana is the natural first dashboard, since Hydrolix bundles it and publishes a Grafana data source plugin. Kibana, Splunk and Spark connect through dedicated bridges, each with its own limits:

• Kibana Gateway: Kibana 8.0+ Discover, dashboards and Elasticsearch-type alerting rules work, but the gateway is read-only, has no ES|QL, and a data view cannot mix Elasticsearch and Hydrolix indices.
• Splunk: Hydrolix Search for Splunk adds the hdxsearch, hdxsql and hdxdescribe commands; Splunk DB Connect is a second route over the ClickHouse HTTP interface.
• Spark connector v3.5.1: Runs on Databricks, Microsoft Fabric and AWS EMR, but only on Spark 3 and Scala 2.12. A known Databricks Runtime 13 dependency clash forces a manual JAR upload instead of Maven coordinates.

Search capability	Hydrolix behavior
Kibana text matching	Literal, case-insensitive
Kibana relevance scoring	Not supported
Column full-text search	Available, off by default

For relevance-ranked search, Elasticsearch stays the better tool. Per-column full-text indexing speeds LIKE, ILIKE and MATCH filters on log messages and URLs, but Kibana Gateway still matches literally, with no tokenization or scoring.

AI Access

The remote MCP server at /mcp has been on by default since v5.10, with client setups for Claude Code and ChatGPT Enterprise, so add it to your permissions review before pointing an agent at production telemetry. Anomaly Detection, which pairs statistical detection with LLM root-cause summaries, is still Limited Availability through support.

My recommendation is to use Hydrolix for time-bounded SQL behind the dashboards you already run, not as a drop-in Elasticsearch replacement.

Deployment, Security and Support

Hydrolix runs on Kubernetes under its own operator, with deployment paths for Amazon EKS, Google GKE, Microsoft AKS and Linode LKE. v6.4.11 (October 19, 2026) added Helm chart installation of the operator. On EKS, sizing starts at c5n.4xlarge for development and c5n.9xlarge for production, and LKE installs above 250 nodes can split platform, intake, query and merge clusters over one catalog and object store.

Self-managing it is a platform-team job, because you own the Postgres catalog and separate ingest, merge and query pools. A new minor line shipped every 4 to 6 weeks in 2026 (v6.0 in June to v6.4 in October), and upgrades carry breaking changes: v6.4 makes project-to-customer assignment immutable, and v6.2 writes v4 partitions that v6.0 and earlier cannot fully use.

Hydrolix’s security controls cover identity, access and transport:

• SSO through Keycloak: SAML 2.0, OpenID Connect and OAuth 2.0.
• RBAC: Column-level access control enforced at query time.
• Config API federation: Bearer tokens signed by external JWT issuers.
• Network and storage: TLS, per-route IP allowlists and encryption at rest through the cloud storage layer.
• Compliance: SOC 2 and GDPR, as stated by Hydrolix.

P1 response is 8 business hours on Standard, 1 hour 24/7 on Premium and 15 minutes 24/7 on Enterprise, and P1 and P2 tickets need a phone call for the SLA to apply. Portland-based Hydrolix raised an $80 million Series C in April 2025 and was named Akamai’s North America ISV Partner of the Year for 2025.

BYOC keeps the data in your own object storage, which matters when data-residency rules rule out a hosted-only log service such as Datadog.

How Does Hydrolix Compare to Competitors?

Hydrolix wins on long, full-fidelity log retention priced per GB; ClickHouse Cloud wins on general-purpose SQL and a self-serve start, and Datadog, Grafana Cloud and Elastic win when a full observability suite matters more than the storage engine.

Tool	Starting price	Billing unit	Best at
Hydrolix	Cloud $0.31/GB ingested with 3 months of retention; BYOC from $0.20/GB	GB ingested; BYOC infrastructure extra	Long log retention on object storage
ClickHouse Cloud	Enterprise, AWS us-east-1: $0.39030 per compute unit-hour + $25.30 per TB-month; $300 trial credits	Compute hours plus storage	General real-time SQL
Grafana Cloud Logs	Pro $19/month with 50 GB; then $0.40/GB written + $0.05/GB processed + $0.10/GB retained	Platform fee plus per-GB charges	Loki and Grafana stack
Datadog Log Management	Ingest from $0.10/GB; 15-day indexing from $1.70 per million events (annual); Flex Logs storage from $0.05 per million events/month	Per GB plus per event; Flex compute via sales	Full observability suite
Elastic Observability Serverless	Ingest from $0.07/GB (Logs Essentials) or $0.09/GB (Complete); retention from $0.017/GB-month	Per GB ingested and retained	Full-text search and relevance
Imply Polaris	Starter from $100/month; ingest $0.35/GB for the first TB	Plan plus per-GB ingest	Managed Apache Druid

These rows use different billing units, so they are starting prices, not comparable monthly bills. Model ingest, retention, query compute and support for one workload before choosing on price.

• Hydrolix vs ClickHouse Cloud: ClickHouse Cloud is the better pick for general SQL and applications beyond logs, with no monthly minimum and $300 in trial credits for 30 days without a card. Hydrolix’s mandatory timestamp filter and heavy ALTER jobs keep it narrower: a log store, not a general analytical database.
• Hydrolix vs Datadog: Choose Datadog when APM, metrics, traces and logs need to live in one product; Flex Logs retains 1 to 15 months, with compute priced through sales. Hydrolix fits as the log data layer under the investigation tools you already run.
• Hydrolix vs Grafana Cloud Logs: Grafana wins for small volumes, with a free tier of 50 GB and 14-day retention, and Pro extends that to 30 days. Hydrolix Cloud’s three months of included retention is the reason to move when 30 days is too short.
• Hydrolix vs Elastic: Elastic is the pick for relevance scoring and full ES|QL. Kibana Gateway keeps Discover and dashboards working on Hydrolix data, but literal matching and read-only access stop it short of replacing Elasticsearch.
• Hydrolix vs Apache Druid and Imply: Imply Polaris suits interactive slice-and-dice on pre-aggregated data, with a $500 trial credit over 30 days. Hydrolix is the stronger fit when full-fidelity logs must stay queryable through several existing interfaces.

Splunk and Cribl Lake publish no per-GB rates. For an existing Splunk deployment, Hydrolix Search for Splunk offloads older data while analysts keep the Splunk interface, rather than replacing Splunk outright.

How I Reviewed Hydrolix

I evaluated Hydrolix v6.4 on the decisions that set workload fit: the AWS Marketplace onboarding and BYOC setup, the project, table and transform flow, ingest options, retention settings and time-filtered SQL. I also checked Grafana, Kibana Gateway, Splunk, Spark and MCP access, the Kubernetes deployment path, security controls and support tiers.

I weighted the append-only design and timestamp requirement heavily, because both constrain migration. I priced Hydrolix Cloud and BYOC at 1 TB a day with software fees kept apart from infrastructure, and compared Hydrolix with ClickHouse Cloud, Datadog, Grafana Cloud Logs, Elastic and Imply without treating unlike billing units as savings. I did not benchmark ingest throughput or query latency.

Prices current as of October 2026.

Should You Store Your Logs in Hydrolix?

Hydrolix is a strong fit for high-volume, time-filtered log investigations that need months of full-fidelity data at a published per-GB rate. At 1 TB a day, Hydrolix Cloud comes to about $9,300 a month before support. Its costs are append-only storage, a mandatory time filter and quote-only pricing outside North America AWS.

• CDN, streaming and media teams: Yes, with Hydrolix Cloud on AWS or TrafficPeak on Akamai.
• Security teams offloading SIEM retention from Splunk: Yes, with Hydrolix Search for Splunk keeping the investigation interface.
• Platform teams over 1 TB a day with data-residency rules: BYOC, if they can run Kubernetes and the Postgres catalog.
• Teams needing frequent updates, joins-heavy BI or a free tier: ClickHouse Cloud or Grafana Cloud Logs instead.
• Teams wanting APM, metrics and logs in one tool: Datadog instead.

Request a managed POC from Hydrolix or start the AWS Marketplace trial with one CDN or application log source.

FAQs

How much does Hydrolix cost?

Hydrolix Cloud costs $0.31 per GB ingested on North America AWS, with three months of retention and queries included. BYOC starts at $0.20 per GB for teams ingesting 1+ TB a day, with your own compute and storage billed separately. TrafficPeak, other regions and longer retention are quoted, and Premium support adds $2,500 a month.

Is Hydrolix based on ClickHouse?

Not exactly. Hydrolix uses the ClickHouse SQL parser and speaks the ClickHouse native and HTTP protocols, but it stores data in its own HDX format on object storage and runs its own ingest, merge and query services. The Query API accepts SELECT only and every query needs a primary-timestamp filter, so check existing ClickHouse queries before migrating them.

Does Hydrolix have a free trial?

Yes, through three offers with different terms: a managed POC on a zero-charge license for the POC term, a 30-day self-managed trial through AWS Marketplace, and a 7-day Hydrolix Cloud trial on AWS Marketplace. Confirm at signup which offer you are on, because the managed and self-managed terms differ.

Can you update or delete data in Hydrolix?

Yes, through asynchronous ALTER TABLE jobs that update or delete rows over a time range. Changes stay invisible until the job is committed, and Hydrolix describes ALTER as a heavy operation not meant for frequent use. It suits append-only events with occasional corrections, not data that changes row by row all day.

What is Akamai TrafficPeak?

Akamai TrafficPeak is Hydrolix run as a managed observability service on Akamai Connected Cloud. It keeps 15 months of full-fidelity data by default, ships managed Grafana dashboards and MCP-based plain-language querying, and needs no separate cloud account. Pricing is by sales quote.