Graylog Enterprise Reviews

We are using only a few parts of its functionality. Its most valuable functions for us are:

• Log collection
• Quick string search in central storage
• Message forwarding through the in-built module
• Message filters. 

We need all these function to fulfill law requirements for cyber security.

We use this system as a central log collector with the possibility to search through the archive backward for specific string definitions.

The biggest problem is the collector application, as we wanted to avoid using Graylog Collector Sidecar due to its architecture. It requires connection outside our network during build from source, so we decided instead to use the obsolete Graylog Collector, which is working fine and in an easy way. It would be great, if that component would get back into the development process. But it is nothing that I could even complain about, as our company is not paying for support.

Solution was build on the 10th of January 2017, so for nearly a year.

The only issue we had was during the Java patch. Graylog's search DB was not able to start up after the upgrade to Java 9, so we returned back to v.8. With that only exception, we have any issues with application or its components.

We never attempted to scale the environment, as its sizing is defined in the planning phase and it fitted us later perfectly.

We never contacted technical support, so I cannot answer this.

There were no solution before Graylog. It was built as new project.

We did not had any experience with Graylog or its components before this project. We had luck in planning phase, the environment was sized properly to its purpose. 

As Graylog also needs other applications/DB's to run, implementation of each component was a separate challenge, as we are not using the default configuration.

I cannot answer this question. Having paid official support is wise for projects.

Yes, we were thinking about the Logstash family, but due to similar issues with the building codes as in the Graylog Collector Sidecar case, we decided for Graylog.

Do not give up. Look forward and good luck. The worst phase was the planning one, so I would offer this advice: Don't underestimate anything. 

Graylog is worth the given effort.

We use it for central log management and log aggregation. We use it for non-security events.

We're using the Community edition, but I know that it has really good dashboarding and alerts.

More customization is always useful.

It has been about three years. I'm currently not using the tool myself, but my team is using it.

It is stable.

It is scalable.

We're not using the Enterprise license. We're using the Community edition, and support is not offered with it.

It was easy to set up. 

We did it ourselves.

We're using the Community edition.

This decision was already made before I got to the organization.

I would recommend this solution to others. It is for small and medium organizations.

I would rate it a seven out of 10.