Skip to main content
TrustRadius
Graylog

Graylog

Overview

What is Graylog?

Graylog, headquartered in Houston, offers their eponymous platform for centralized log management that helps users find meaning in data faster so as to take action immediately. Graylog is available via Enterprise and Cloud plans, but also has a Small Business…

Read more

Learn from top reviewers

Useful and free SIEM tool

Rating: 8 out of 10
June 16, 2022
IncentivizedVetted ReviewVerified User
Allows insight into logs from various systems and products that would otherwise be time consuming to access and identify. Dashboards can be customised to your preferences and ...
Continue reading
Verified user
Professional
Graylog3 years of experience

Clean, robust and intuitive central logging

Rating: 7 out of 10
January 18, 2022
IncentivizedVetted ReviewVerified User
We have more than 60 applications, ranging from websites, Winforms, windows services, API's and console executables. All of them need to log their tracing and/or error informa...
Continue reading
Verified user
Team Lead
Graylog6 years of experience

Graylog, Free Vs. Paid

Rating: 9 out of 10
April 29, 2020
IncentivizedVetted ReviewVerified User
Graylog is currently implemented for use across the entire organization at each deployment that I have provisioned. However, Graylog is only referenced by myself, or Informati...
Continue reading
Verified user
Consultant
Graylog1 year of experience

Graylog can compete against the big boys.

Rating: 9 out of 10
January 29, 2020
IncentivizedVetted ReviewVerified User
We currently use Graylog as a log aggregator and some light weight SEIM. However, we haven't had the cycles to use the other features of it. Presently solves our centralized l...
Continue reading
Jeremy Cejka
Engineer - Information Technology
Principal Systems Engineer
Research Innovations
Graylog3 years of experience

Liven up your logging with Graylog!

Rating: 9 out of 10
December 9, 2019
IncentivizedVetted ReviewVerified User
We use Graylog to collect messages from a variety of different systems like network switch and routers to wifi controllers. We use Graylog to group and create graphs to show s...
Continue reading
Verified user
Administrator
Graylog2 years of experience
Log in with LinkedIn to see content from your network
Return to navigation

Product Demos

Demo GrayLog 2 with Laravel5 app

YouTube

Demo GrayLog 2 with Rails app

YouTube

Send Syslog from MuleSoft RTF to GrayLog

YouTube

Graylog Security

YouTube
Return to navigation

Product Details

What is Graylog?

Graylog Video

Tour of Graylog v4.0

Graylog Competitors

Graylog Technical Details

Deployment TypesOn-premise, Software as a Service (SaaS), Cloud, or Web-Based
Operating SystemsWindows, Linux, ,
Mobile ApplicationNo

Frequently Asked Questions

Graylog, headquartered in Houston, offers their eponymous platform for centralized log management that helps users find meaning in data faster so as to take action immediately. Graylog is available via Enterprise and Cloud plans, but also has a Small Business Plan, and an Open (free) plan with limited features.

Splunk Enterprise, Datadog, and Logz.io are common alternatives for Graylog.

Reviewers rate Support Rating highest, with a score of 3.6.

The most common users of Graylog are from Mid-sized Companies (51-1,000 employees).
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews From Top Reviewers

View all reviews
(1-4 of 4)

Graylog is GREAT

Rating: 9 out of 10
Incentivized
December 05, 2018
Verified User
Technician in Information Technology
Utilities Company, 51-200 employees
Vetted Review
Verified User
Graylog
1 year of experience
Use Cases and Deployment Scope
We use Graylog to view all of our system logs in one place. We use this software to back up our logs so in the event we need to review them we can go back as far as we need to. This software allows us to collect all our data easily.
Pros
  • Manages logs for a variety of devices
  • Easy to set up
  • A great open source solution
Cons
  • If you don't know your way around Linux setup would be tricky. Some step by step videos would be helpful.
Likelihood to Recommend
This is well suited for a small to medium sized environment where you are looking to collect all your system logs. In larger scale environments it would be trickier to pull this software off. The software can only handle a certain amount of logs per second, if you have lots of devices you should invest in a more premium product.
Return on Investment
  • This is a perfect solution for us and didn't cost us a dime.
Alternatives Considered
Graylog provides some great functionality for free. There are some more premium products that would handle more logs and would be a little easier to configure.
Other Software Used

Useful and free SIEM tool

Rating: 8 out of 10
Incentivized
June 16, 2022
Verified User
Professional in Information Technology
Information Technology & Services Company, 11-50 employees
Vetted Review
Verified User
Graylog
3 years of experience
Use Cases and Deployment Scope
Allows insight into logs from various systems and products that would otherwise be time consuming to access and identify. Dashboards can be customised to your preferences and Alerts/emails can be defined when specific events or patterns occur, which is not possible directly from the log source. Our use case is primarily security related looking at access/sign-in logs from various platforms and then sending alerts as required.
Pros
  • Ingesting various log sources
  • Dashboards - Customisable
  • Event alerts/emails
Cons
  • Support for more log sources
  • Event alerts/emails - Some cases where unable to separate data from multiple clients, and no easy fix
  • API - Limits results to 10,000 and can cause server to lockup on queries that exceed the limit
Likelihood to Recommend
Well suited for scenarios such as:
  • Detecting user OS logins, or user logins from unknown IPs etc.
  • Access attempts made on a firewall or other network infrastructure
  • Monitoring changes to Active Directory Groups
Less suited for scenarios where logs and alerts are time critical, eg.as soon as an event occurs an alert is generated and sent
Most Important Features
  • Multiple log sources
  • Customisable Dashboards
  • Event alerts/emails
Return on Investment
  • Able to offer monitoring services to new and existing clients to increase revenue
  • Staff have increased billing percentage
  • Potential to expand security services
Other Software Used

Level Up Your Logging

Rating: 7 out of 10
Incentivized
June 30, 2019
Verified User
Engineer in Information Technology
Internet Company, 501-1000 employees
Vetted Review
Verified User
Graylog
3 years of experience
Use Cases and Deployment Scope
Graylog is used to aggregate logs and SNMP traps from our network devices and Linux servers. We not only aggregate and store logs but extract values to make logging more searchable than using flat files with BASH utilities (grep, cut, awk, etc) to search. For our critical devices, we also use it to forward logs to a room in our private chat service via a custom integration.
Pros
  • Graylog does a great job of its core function: log aggregation, retention, and searching.
  • Graylog has a very flexible configuration. The backend for storage is Elasticsearch and MongoDB is used to store the configuration. You have to option to make your configuration as simple as possible by storing everything on one box, or you can scale everything out horizontally by using a cluster of Elasticsearch nodes and MongoDB servers with several Graylog servers pointed to all the necessary nodes.
  • Graylog does a good job of abstracting away a fair portion of Elasticsearch index management (sharding, creation, deletion, rotation, etc).
Cons
  • Some aspects of Graylog are less than intuitive. For example, if you want to run different extractor rules on different device types due to format differences, you need to create different inputs. Since inputs are their own processes that require ports to be bound to them, you either need different IP addresses for each input or a different (read: non-standard) port, which can make the device configuration more complicated.
  • Although Graylog abstracts quite a bit of Elasticsearch management away, it is by no means a turnkey solution. Upgrades to Graylog can require upgrades to Elasticsearch, which occasionally requires manual intervention to Elasticsearch. Same goes for mongo. If you're looking to scale out, there is some documentation to get you started, but the heavy lifting is on you.
  • As everything is stored in Elasticsearch, there are no more flat files to tail; moving from a "traditional" logging aggregator like Syslog(-ng), a culture change is going to be required.
Likelihood to Recommend
If you already have a basic understanding of Elasticsearch and/or MongoDB, Graylog will be a great fit when it comes to log aggregation. It will be a decent option even if you don't have any experience but have the time and willingness to roll up your sleeves that learning those tools will require. Graylog supports plugins to extend functionality for things like SNMP traps, telemetry collection, and solar flares. As is the case with most software with plugins, if the core functionality for which you are looking (i.e. not logging) is based on a plugin, Graylog probably isn't for you. The majority of the plugins in the marketplace are developed by third-parties looking to solve their specific use case so bug fixes and new features are not a given.
Return on Investment
  • We do not purchase support, so the only operational cost is that of the time it takes to maintain it.
  • All the components of Graylog that we use are free and open source, so there was no capital expense other than that of servers (repurposed from another recently-decommissioned project).
  • If there is a software crash that doesn't recover gracefully, it's usually something obscure that will take a while to diagnose and fix. Unless you build out a distributed and more resilient system with no single points of failure, that may have an impact on the organization or industry requirements for compliance.
Alternatives Considered
We previously used Syslog(-ng) and considered moving to the Logstash with Kibana as part of the standard ELK stack as we are consumers of ELK in other scenarios, but we determined that maintaining a distributed Graylog system was going to require less work overtime for our main objective than ELK. Splunk was also briefly considered, but holy wow do you pay significantly for licensing to perform the same functionality of Graylog.

Clean, robust and intuitive central logging

Rating: 7 out of 10
Incentivized
January 18, 2022
Verified User
Team Lead in Information Technology
Automotive Company, 501-1000 employees
Vetted Review
Verified User
Graylog
6 years of experience
Use Cases and Deployment Scope
We have more than 60 applications, ranging from websites, Winforms, windows services, API's and console executables. All of them need to log their tracing and/or error information to a central location. It needs to be central because you don't want to search for this location, especially when you only have 5 minutes to solve a problem. We used to have a dedicated database for logging, but this does not eliminate the time lost searching for "the" logs. Also, [the] configuration used to be a manual and self-made business that wasn't always clear. Graylog is a dedicated logging solution that comes "out of the box" and is made accessible through a well-known plugin architecture (log4net if you're developing with the .NET framework).
Pros
  • Nice search interface and powerful search options
  • JSON extractor to "extract" variables and values from JSON input.
  • Clear and intuitive dashboards
Cons
  • In the front end, the search "tricks" could have been made a little easier to find. There seems to be some kind of "search language" where you can use keywords like "AND" and "OR," etc. (much like SQL language). But it's totally unclear what does work and what doesn't. If you don't know that it's there, you'll never find it. Of course, after you do know it, you can find many examples online on how to use it.
  • The backend is not for the inexperienced. Graylog is based on elastic search and MongoDB. And it's Linux. This means that Graylog is actually 3 applications that you need to configure in a Linux environment. This means that you need quite some experience to get this running. Fortunately, though, things are kept as simple as possible. What I mean is that at first, the task seems daunting, but then you'll find that there's not much to it after all.
  • We've had multiple occasions that disk size was full or indexes went larger than allowed. When this happens, the systems can become corrupt. The solution is to just delete the indexes, but it took quite some time to find this out.
  • We disabled "Automatic updates" on the Linux server because unattended updates always lead to problems. This is not a real problem, or solely related to Graylog, but worth mentioning. Updates are best handled manually.
Likelihood to Recommend
For small companies, Graylog is the best solution possible. It's easy to configure and "just works." Above everything else, it's free. The only thing I hold against it is the fact that it's Linux-based. [This] makes sense because Elasticsearch is Linux-based. But Linux adds a layer of complexity that we don't need for something basic as a logging server. I'm pretty sure that we would have had a logging server years earlier if I had to convince quite a few decision-making people to go ahead with it anyway.
Most Important Features
  • Central (the fact that it's central), one place to log them all
  • Multiple ways to log, one I already mentioned (log4net)
  • AD support
  • The fact that it's free
Return on Investment
  • Negative: None. There is no negative impact by using Graylog.
  • Speed of solving bugs. Logging is so accessible and easy to search that we spend a lot less time [searching] for specific errors.
  • Better health of applications. Since monitoring the logs is so easy, it's very easy to keep an eye on the tracing to see if things are going smoothly and according to plan.
Alternatives Considered
Azure Monitor is not exactly what I mean, but I couldn't find Azure Application Insights. Anyway, for a large organization, Azure makes more sense than using Graylog because a lot of logging will already be inside Azure. And you don't want to have two "central" logging locations. But Azure is chaos and highly "not intuitive." So for small and mid-size organizations, Graylog is still the better option.
Other Software Used
Return to navigation