What it does
Graylog is a log-management and security platform for collecting and searching operational data. Inputs accept push or pull log sources, while pipelines, streams, searches, dashboards, and alerts help teams organize and investigate that data. Graylog Open is a free, self-managed edition; Enterprise and Security add commercial capabilities, and Graylog Cloud is the hosted option.
Graylog gives operations and security teams a shared place to collect and inspect logs. The official site presents Graylog Open, Enterprise, Security, and Cloud as editions or services within the Graylog platform, rather than unrelated products. The current pricing page describes Graylog Open as always free, self-managed, and source-available under SSPL. It says teams choosing that edition need engineering time to build and maintain their own log-management system. Paid Enterprise and Security tiers are also listed; the page shows starting figures based on daily volume or annual consumption, so a workload-specific bill should not be inferred from a headline price.
Bring in one representative source
Choose an input that fits the source, such as a listener for Syslog, CEF, GELF, or Beats data, or a pull input that retrieves logs from an endpoint. Configure it in the Graylog interface, then confirm that the records arrive and are parsed into predictable fields. The input guide recommends TLS for protecting data in transit and distinguishes TCP's network-level acknowledgements from UDP's lack of delivery guarantees.
Search to detect, then investigate
Once useful data is flowing, search within a time range using Graylog's query syntax, which is based on Apache Lucene's parser. Stream selections and reusable filters narrow the search; saved searches can also feed dashboard widgets and event definitions. A query or event rule can detect a pattern in log data, but the resulting signal is evidence for an operator to investigate, not an automatic explanation or repair. The search documentation notes that useful results depend on the logs being parsed and normalized consistently; pipeline rules or supported Illuminate packs can help with that preparation. The docs describe a search scripting API, and Graylog's pricing page lists REST API access for Graylog Open.
The operational trade-off depends on deployment. With Graylog Open, the team supplies and maintains the infrastructure; a hosted option shifts that hosting burden, while commercial editions add separate capabilities. Review the SSPL terms for Graylog Open rather than treating its source availability as a claim of a permissive open-source license.
Strengths
- Offers listener and pull inputs, with documented support for common log formats and protocols.
- Searches can be reused and connected to dashboards and event definitions.
- The pricing page lists REST API access for Graylog Open.
Watch out for
- The free Graylog Open edition is self-managed, and the vendor says it requires engineering time to build and maintain.
- Graylog Open is labeled source-available under SSPL, so its license terms should be reviewed for the intended deployment.
- Search quality depends on logs arriving and being parsed or normalized in a predictable way.
Best for
- Operations teams centralizing logs from applications and infrastructure.
- Security teams evaluating a log-management and SIEM platform.
- Teams able to operate a self-managed logging system or compare hosted and commercial editions.
Sources
- Graylog | SIEM & Enterprise Log Management (Oct 25, 2026)
- Graylog Pricing Plans & Features Comparison (Oct 25, 2026)
- Inputs (Oct 25, 2026)
- Search Your Log Data (Oct 25, 2026)
- graylog2-server/LICENSE (Oct 25, 2026)