Case Study: Box achieves 50% lower logging costs and expanded observability with Elastic

Deploying the Elastic Stack for observability — one microservice at a time

Box, a cloud content management provider serving millions of users and over 95,000 enterprise customers, needed better observability to meet strict SLAs as it transformed a monolithic backend into hundreds of microservices. Its legacy MySQL reporting and a Splunk-based logging system—priced by data ingest—wasn’t scaling: indexer failures, high latency, and rising ingest costs forced engineers to limit logging and left reports slow or broken.

Box migrated reporting and logging to the Elastic Stack (Elasticsearch, Logstash, Beats, Kibana) using an “Arta” pipeline, rolling the platform out one microservice at a time. The move halved logging ingestion costs, resolved reporting bottlenecks, sped up queries, and gave ~500 engineers broad, real-time visibility via hundreds of Kibana dashboards (now handling ~180 billion documents, ~190 TB total, ~20 TB/day ingest), while enabling future plans for APM, ML and SIEM.

Box

Deepak Wadhwani

Engineering Manager for the Observability Team