Graylog

What Graylog actually is

Graylog is a log management and SIEM platform with an open core and an unusually long track record. It started in 2009 as a side project of Lennart Koopmann in Hamburg, Germany — the Graylog2 project that grew out of his own log-analysis needs — became a company (originally Torch) in 2012, took its first venture money in 2014, relocated to Houston, Texas in 2015, and shipped its first commercial edition in 2016. Today Graylog, Inc. runs from Houston with offices in Boulder, London, and Hamburg, and the product line spans Graylog Open (free), Graylog Enterprise, Graylog Security (its SIEM edition), Graylog API Security, and the managed Graylog Cloud Platform.

The architecture is the classic centralized-logging shape: collectors ship logs via syslog, GELF, or HTTP APIs into a Graylog core server, Graylog Data Node or OpenSearch handles indexing and storage, and MongoDB holds metadata and configuration. On top sit full-text search, extractors that parse unstructured lines into searchable fields, stream-based routing, dashboards, alerts, and pipelines. Written in Java and running on Linux, it is infrastructure software in the traditional sense: you size it, you run it, and it does exactly what the tin says.

What keeps Graylog relevant against hosted competitors is the combination of cost control and data ownership. Self-hosted Graylog has no volume restrictions and no per-GB invoice, which matters because log volume is the one dimension that grows relentlessly. The free edition is source-available under the Server Side Public License — a point worth stating precisely: SSPL is not an OSI-approved open source license, and it restricts offering Graylog as a managed service. For internal use it is free in every practical sense; for resale or SaaS wrapping, read the license.

Current releases (the 7.x line) continue the platform's steady evolution, and the vendor has added AI-assisted investigation ("Arti") and stronger SIEM positioning for lean security teams. In our view the honest category for Graylog has shifted over the years: it began as log management for sysadmins and now sells primarily to security and IT operations teams who need detection without a hyperscaler bill.

Pricing: what you really pay

The entry price is zero, permanently. Graylog Open is free with no volume restrictions and community support — the vendor's own words on its pricing page. There is no trial clock and no feature-limited free tier in the hosted sense; you download it and run it. The real costs are the ones the license does not show: the servers underneath (OpenSearch or Data Node plus MongoDB are storage-hungry at high ingest), and the engineering time to run them.

Commercial pricing is where transparency drops. Graylog Enterprise, Graylog Security, and Graylog API Security are priced on log ingestion volume, with volume licensing — but the numbers are quote-based, and the pricing page routes you to a sales conversation rather than a calculator. The Graylog Cloud Platform similarly prices by ingest tier. For budgeting purposes, assume per-GB-per-day pricing on the paid editions with discounts at scale; the exact rates are negotiated. We list the absence of public pricing as a genuine minus — a lean team cannot model a three-year cost without talking to sales.

The trade the vendor itself frames is "results or resources": Graylog's pitch is that mainstream SIEMs price per gigabyte so aggressively that teams stop collecting the logs they need, while Graylog's model lets a small team keep full visibility. There is truth to it. But teams should do the math on both sides: self-hosted Graylog's cost is mostly people-hours and disk, and at very high ingest volumes a managed platform can still win on total cost once you count operations. The sensible path is the one Graylog supports: start on Open, buy the commercial edition when you need the enterprise features or support, and keep the same deployment.

Performance & infrastructure

Because Graylog is self-hosted, "performance" is whatever you build. The platform scales horizontally — multiple core servers, a sharded OpenSearch or Data Node cluster, MongoDB for metadata — and the vendor supports distributed architectures for high-volume streams. Search speed over large indexes is a strength the community consistently reports, and the pipeline processing engine lets you parse, enrich, and route without shipping logs through a separate transformation layer.

The operational surface is the real infrastructure story. You are running a JVM-based core, a search/index cluster, and a database; upgrades, index rotation, retention, and shard management are your responsibility. Graylog's own documentation covers retention tuning and index set design properly, but capacity planning for log storage is a discipline in itself — the rule of thumb in the community is that ingestion never shrinks. For teams without dedicated ops capacity, the Graylog Cloud Platform removes exactly this burden, and its existence is an acknowledgment that self-hosting is not for everyone.

For security use, the architecture keeps data where you put it — an advantage for GDPR and data-residency requirements that hosted competitors cannot match without regional contracts. Audit logging and SAML-style enterprise access controls live in the commercial editions rather than Open, which matters if your compliance regime needs them. Support tiers run from the community forum (which is active and technically competent) through paid support with response commitments, plus professional services for implementation. Documentation at docs.graylog.org is thorough, and the Graylog Academy offers free training courses.

Where it falls short

The license deserves repeat emphasis. Graylog Open is source-available under SSPL, not open source under an OSI definition. If your organization has a policy requiring OSI-licensed dependencies, or you plan to embed Graylog in a service you sell, the license is a decision point, not a footnote. (The commercial editions use volume licensing.)

Second, the free edition's ceiling is real. The features that make Graylog workable as a security product — audit logs, some enterprise integrations, and the SIEM content in Graylog Security — sit behind the paid editions. Running Open as your audit-grade logging platform eventually meets a compliance requirement it cannot satisfy without opening the wallet.

Third, self-hosting cost is underestimated by everyone the first time. OpenSearch indexing is disk- and memory-intensive, MongoDB adds another stateful component, and a high-volume deployment will spend more on storage than on Graylog itself. Teams that arrive expecting "free log management" and leave with a half-maintained cluster are a known pattern; the fix is honest capacity planning or the Cloud Platform.

Fourth, the learning curve for extraction rules, pipelines, and index set design is steeper than the dashboard suggests. The UI is competent, but making messy logs genuinely searchable takes deliberate parsing work. And paid pricing being quote-only makes vendor comparison harder than it should be.

Who should pick this

Our pick for infrastructure teams and DevOps engineers who want centralized log analysis they control: full data ownership, no per-GB invoice, and the freedom to run on their own hardware or private cloud. It is also a strong mid-market SIEM candidate for lean security teams — the Graylog Security edition bundles detection content and workflows that would otherwise require a much pricier platform.

We would not pick it for teams with no operational capacity to run a JVM/search/database stack; those teams should compare the Graylog Cloud Platform against Datadog, Grafana Cloud's Loki, or Elastic Cloud on total cost. Organizations that need OSI-licensed software specifically should look at alternatives or accept SSPL consciously. And if your requirement is turnkey compliance reporting with public pricing you can budget against, quote-based enterprise editions make the paper exercise harder.

For self-hosters, the practical advice is simple: budget storage first, index retention second, and parsing third — in that order. See how log platforms compare in /category/monitoring-hosting and on /benchmarks.

Key takeaways

• Graylog dates to 2009 in Hamburg (founder Lennart Koopmann); the company relocated to Houston, Texas in 2015 and now spans SIEM, log management, and API security editions.
• Graylog Open is free with no volume restrictions — but source-available under SSPL, not OSI open source.
• Commercial editions (Enterprise, Security, API Security, Cloud Platform) price on log ingestion volume with quote-based licensing — no public calculator.
• Self-hosted architecture (core + OpenSearch/Data Node + MongoDB) gives full data ownership and data-residency control at the cost of real operational work.
• Enterprise features such as audit logging and the SIEM content sit in the paid editions, not Open.
• Our pick for ops-capable teams wanting log analysis without per-GB billing; the Cloud Platform exists precisely for those without that capacity.

Sources

• https://en.wikipedia.org/wiki/Graylog
• https://graylog.org/pricing/
• https://graylog.org/products/cloud/
• https://graylog.org/products/source-available
• https://comparitech.com/net-admin/graylog