In 2018, Lyft transitioned its operational logging system from Splunk Cloud to Amazon Elasticsearch Service (Amazon ES) and eventually to a self-managed Elasticsearch deployment, seeking to unify observability and security data while reducing costs and administrative overhead. Initially, Lyft's Observability team faced challenges with Splunk's retention limits, ingest backups, and scaling costs, prompting a switch to Amazon ES. However, limitations such as outdated versions, storage performance issues, and lack of direct cluster access led to operational inefficiencies, prompting another migration. With a slightly larger team than that used for the Splunk migration, Lyft successfully moved to a self-managed Elasticsearch in two weeks, gaining full control over system features and operational aspects. This transition allowed Lyft to handle increased log ingestion rates and to resolve issues independently, improving the overall reliability and efficiency of its logging infrastructure.