Graylog review

Graylog combines log management with SIEM features for security, IT, operations and audit teams. It collects logs from different systems, brings them into a searchable timeline and supports dashboards, pipelines and data routing. Its security tools are designed to help teams detect and investigate threats, group related alerts into risk-scored incidents, and assemble event timelines or draft incident reports with AI assistance. The platform also includes prebuilt detection content for common data sources, attack frameworks and audited standards, plus controls for log tiering and retention.

There are three editions in the published pricing information: Graylog Open, Enterprise and Security. Open is a free, self-managed, source-available edition under SSPL, with no volume restrictions listed. Enterprise adds features including data lake routing and tiering, SSO and user audit logs. Security includes Enterprise features plus anomaly detection and maintained detection rules mapped to MITRE ATT&CK. Graylog is a log and SIEM product, not a single-pane observability suite in the published materials.

Graylog’s clearest appeal is control over log collection without a published volume cap on its free edition. Graylog Open lists support for Syslog, CEF, GELF, Beats and Netflow, along with search, dashboards, pipelines and routing. That gives teams able to operate the stack a free starting point; the trade-off is that they own the maintenance.

The paid editions add capabilities aimed at larger operational and security needs. Enterprise lists data lake routing and tiering, SSO, teams, LDAP access and user audit logs. Security adds anomaly detection and maintained detections mapped to MITRE ATT&CK. The feature set also includes risk-scored incidents, prebuilt detection content and AI-assisted investigation tools. Those are relevant if the goal is to make security investigations more structured, rather than simply store and search logs.

Some Reddit users describe long-running deployments and practical value. A commenter on r/sysadmin said Graylog provided useful information, alerting and dashboards after configuration; another reported using it across several employers and saving on SIEM licensing. These are individual accounts, not a guarantee of lower costs or easier operations. Still, they suggest the platform can suit teams willing to run and configure their own logging environment.

The main drawback is the cost jump from free to paid. Graylog Enterprise starts at $15,000 per year and Security at $18,000 per year, according to the pricing information; monthly billing prices are not published. Both paid plans start at 10 GB/day or 100 GCUs. GCU bundle prices are not published, so teams should ask for a quote rather than assume the listed starting price covers their expected ingest. Training, professional services and a Technical Account Manager also have no published prices. There are no device-count or user-count licensing fees listed.

Free does not mean hands-off: Graylog Open is self-managed, and one r/sysadmin commenter specifically advised being prepared to manage Elasticsearch, which they described as central to the setup. That same thread includes an account of an upgrade disrupting custom dashboards and API-based reports. It is one user’s experience, but it is a reason to check upgrade compatibility before moving a heavily customized deployment.

Graylog’s materials here do not publish a free trial or a paid monthly rate. Teams comparing it with hosted services should include infrastructure, administration and migration work in the cost comparison; the published sources do not quantify those costs.

Graylog Open is free, with no volume restrictions listed. It includes search, dashboards, pipelines and data routing, but support is community-based and the edition is source-available under SSPL.

Paid licenses are annual subscriptions; Graylog does not publish monthly billing prices. Enterprise starts at $15,000/year, equivalent to $1,250/month. Security starts at $18,000/year, or $1,500/month. That is a $3,000 annual jump for Security, which adds anomaly detection and maintained detections mapped to MITRE ATT&CK. Both paid plans start at 10 GB/day or 100 GCUs.

Budget for more than the license if you need help: training, Professional Services and a Technical Account Manager are available, but their prices are not published. GCU bundle prices are also not published. Graylog says it does not charge by device or user count, but the annual commitment and unpublished add-on costs make it harder to compare against tools with monthly pricing.

Treat a move to Graylog as a logging-platform project, not a quick tool swap. The published product details describe centralized collection, consistent field names, pipelines and data routing; you’ll need to account for how your sources and existing workflows map to those features. Graylog’s verdict also flags upgrade management and Elasticsearch operations as responsibilities for teams running it themselves.

Before switching, confirm your ingestion needs against the paid plans’ starting point of 10 GB/day or 100 GCUs. Open has no volume restrictions listed, but it is source-available under SSPL and includes community support. The published material does not specify export formats, migration tooling or a path for transferring historical data, so verify those before committing. It also contains no Reddit reports we can cite about why users leave Graylog. The practical reasons to investigate are the annual paid commitment, managing upgrades, and whether your team wants a metrics-and-APM suite—Graylog is not positioned as one in the published brief.