TL;DR: Pick on operating cost and pricing model, because search works everywhere. Self-hosted ELK or Loki trades a lower bill for a cluster you now run. Splunk and Datadog trade money for not running it. Whatever you choose, the volume decision matters more than the vendor: nobody has ever regretted logging less at the error level.
How to approach it
Refuse to answer on features, because all of them index and search logs adequately. Answer on who operates it, how it is priced, and what happens at ten times the volume. Then make a recommendation, since a balanced comparison with no choice at the end is the answer interviewers hear most and value least.
A strong answer
Self-hosted ELK (Elasticsearch, Logstash or Fluent Bit, Kibana) gives you a powerful search engine and no licence cost. What you take on is a stateful distributed cluster: shard sizing, hot-warm-cold tiering, index lifecycle policies, rolling upgrades, and a cluster that goes yellow at 2am because a node filled its disk. Storage is the visible cost and the operator's time is the real one. It suits an organisation with the people to run it and enough volume that licensing would hurt.
Grafana Loki is worth naming because it changes the trade. It indexes only labels rather than the full log body, so it is far cheaper to run and store, and its querying is weaker: you filter by label then grep within a stream, rather than doing arbitrary full-text search. If you already run Prometheus and Grafana, the labels line up and the operational model is familiar. For most teams whose actual log usage is "show me this service's errors in this window", it is enough.
Splunk is the strongest search and analysis of the three, with a query language built for it, and it is priced accordingly. Historically by volume ingested per day, which creates the specific failure mode of teams dropping useful logs to stay under a licence. It is entrenched in large enterprises and in security operations, where its correlation capability is the reason.
Datadog and similar managed platforms bundle logs with metrics, traces and dashboards, which is a genuine advantage: correlation across the three is built rather than integrated. The pricing is per host plus per gigabyte ingested plus retention tiers, and it can escalate quickly and quietly. The number to model before committing is cost at your projected volume in two years, not today.
The recommendation: for most teams under a few hundred gigabytes a day, a managed platform is cheaper than the engineer you would need to run a cluster, and the correlation with metrics and traces is worth real money during an incident. Past that volume, or where data cannot leave your network, self-hosting starts winning. If you are already invested in Grafana, Loki is the least expensive path that still works.
The decision that matters more than the vendor is what you send. Most log volume is info-level lines from successful requests that nobody has ever read. Sampling those aggressively, keeping everything for errors, and setting retention by value (thirty days hot for debugging, a year in object storage for compliance) usually cuts the bill by more than switching vendors would.
What interviewers probe next
"How do you avoid lock-in?" Emit structured logs and ship through a vendor-neutral collector, OpenTelemetry or Fluent Bit, so the destination is configuration. Writing vendor SDK calls into application code is what makes a migration a rewrite.
"What about compliance and data residency?" Often the whole decision. Logs contain personal data, so a managed platform means processing agreements, a region choice, and a retention policy you can defend. That is frequently what rules out a vendor regardless of price.
"How do you keep sensitive data out?" Redact at the collector, before it leaves the host, because once a token is indexed it is in backups and in the vendor's storage. Scrubbing at query time protects nothing.
Common mistakes
Choosing on search features, which are adequate everywhere, instead of on operating burden and pricing shape.
Modelling cost at today's volume, then being surprised when the bill tracks growth faster than revenue does.
Running self-hosted Elasticsearch without anyone owning it, which works until the first cluster incident.
Logging everything at info and solving the resulting bill by shortening retention, which removes the old data you needed and keeps the noise.