Graylog Reviews

Name: Graylog
Brand: Graylog
Rating: 4.0 (20 reviews)

Vendor: Graylog

4.0 out of 5

20 reviews
95% willing to recommend

473 followers

Start review

What is Graylog?

Graylog is purpose-built to deliver the best log collection, storage, enrichment, and analysis. Graylog is:

Get the Graylog Buyer's Guide and find out what your peers are saying about Graylog, Wazuh, Dynatrace and more!

Graylog is the #16 ranked solution in Log Management Software. PeerSpot users give Graylog an average rating of 8.0 out of 10. Graylog is most commonly compared to Wazuh: Graylog vs Wazuh. Graylog is popular among the large enterprise segment, accounting for 49% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 18% of all views.

Helped 849,686 peers since 2012

Featured Graylog reviews

Ivan Kokalovic

DevOps Engineer at Proton Technologies

Graylog is valuable because it bridges technical knowledge to non-technical teams, presenting complex backend processes in a simple timeline. It boosts the knowledge of sales and customer support teams by allowing them to see the backend operations without needing to read the code. Its API is flexible for visualization, and its powerful search engine efficiently handles large volumes of log data. Moreover, its stability, fast search capabilities, and compatibility with languages like ANSI SQL enhance its utility in IT infrastructure.

Read full review

Andrey Mostovykh

Senior Data Architect at a non-tech company with 201-500 employees

We stopped using it for analytics because of its price, and at the moment, we are using it mostly for log centralization. If you use it with high traffic for analytical purposes, as well as for the logs, the infrastructure costs are unbelievable. Graylog is a great product backed by Elasticsearch as the storage and query engine. It is just an interface on top of Elasticsearch and some Elasticsearch management. The indexes that are kept in Elasticsearch are managed by Graylog software. Elasticsearch is a decent product, but it's very infrastructure-heavy. It requires lots of resources, and if you make a mistake with provisioning, you are likely to not get a cluster back. We had a couple of outages like that, and we hated that. So, we ended up over-provisioning resources just to avoid such situations from happening. If you have a whole team trying to fix the Graylog instance for two days, that's a bit too much. That may be my Norwegian take on it, but the engineering resources are expensive. It's better to just provision the infrastructure. Overall, the product is great, and the features are just fine, but the infrastructure cost is what is killing it. The infrastructure cost is the main issue. I like the rest. If the infrastructure costs could be lower, it would be fantastic. I'm not sure if they can improve the infrastructure cost with the way Elasticsearch is. If they keep using Elasticsearch, maybe there are some opportunities there, or they can support other backends with cheaper storage. They could have a different backend to replace Elasticsearch or do some tweaks to Elasticsearch to reduce the costs. There could be partial parsing of logs or parsing on demand so that when you write data through Graylog to Elasticsearch, it doesn't need to crunch in every detail requiring that much CPU.

Read full review

Peter Malaty

Sr. DevOps Engineer at TechStyle Fashion Group

Graylog needs to improve their authentication. Their AD integration is really bad. When it comes to ACL's, access control lists, where you want to have different group memberships and control who gets access to what, it really could use major improvements. It seems like a beta authentication version that they came up with in a hurry and said, "Hey guys, we've got something going for you. Use it until we think of something later on." I believe their enterprise version has improved some of these features, but I use the open source version. The second thing would be the way they handle live logging. The fact that Graylog displays logs from the top down is just ridiculous. I've never seen anything that logs this way except for Graylog. I believe this is an issue because they have the selector going in that direction, so it would make sense that they have to implement it that way, but it's definitely not cool. When you're looking at Graylog's live logging, whether it's doing a one-second or five-second pull, you'll notice that new log lines are placed at the top of the screen, not the bottom of the screen. I find this ridiculous because normally when you're looking at logs anywhere, on Linux, even in Windows, you're going to see that the logs are generated at the bottom. That's one thing that Graylog definitely needs to improve. Graylog also needs to invest some time to improve the performance and how they handle the maintenance of Elasticsearch. An added feature I would like to see is the capacity to delegate most of the backend maintenance to the frontend UI. When you have somebody from the service desk working on the solution or somebody who's not a technical person, they could run some of the maintenance stuff directly from the UI. Another thing is something that I saw in LogDNA, where you could have a color based on log regex. For example, it would color the timestamps next to the log lines orange, make the source of the log purple, and then make the actual log content black. That would be very nice to see in Graylog.

Read full review

Graylog mindshare

As of May 2025, the mindshare of Graylog in the Log Management category stands at 6.7%, up from 5.8% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Log Management

PeerResearch reports based on Graylog reviews

Type	Title	Date
Category	Log Management	Apr 30, 2025	Download
Product	Reviews, tips, and advice from real users	Apr 30, 2025	Download
Comparison	Graylog vs Wazuh	Apr 30, 2025	Download
Comparison	Graylog vs Splunk Enterprise Security	Apr 30, 2025	Download
Comparison	Graylog vs Datadog	Apr 30, 2025	Download

Title	Rating	Mindshare	Recommending
Wazuh	3.7	14.8%	79%	46 interviews Add to research
Dynatrace	4.4	5.0%	95%	346 interviews Add to research

Valuable Features

Graylog's key aspects include log collection, Elasticsearch integration, real-time access, alerting, custom alerts, and dashboard enhancements. It supports centralized logging, message forwarding, stream alerting, and diverse environment coverage. Features like full text search, UDP logging, log enrichment, and API flexibility are highlighted. Its user-friendly interface facilitates non-technical teams' data access. Stability, minimal maintenance, and open-source nature add significant value, making it highly compatible with tools like Slack and OpsGenie.

"Graylog is valuable because it bridges technical knowledge to non-technical teams, presenting complex backend processes in a simple timeline."
"Graylog is very handy."
"It has data adapters and lookup tables that utilize HTTP calls to APIs."

Room for Improvement

Graylog users experience challenges with its authentication system, especially regarding AD integration and access control. They find the alerting system inflexible and desire enhanced dashboard visualization. The collector application presents architectural issues, and users want improvements in Elasticsearch tuning and Kubernetes support. There is a need for better documentation and user interface features, such as font size adjustments. The infrastructure cost is high, impacting the use of Graylog for analytics.

"When it comes to configuring the processing pipeline, writing the rules can be very tedious, especially since the documentation isn't extensive on how the functions provided for these rules work."
"When it comes to configuring the processing pipeline, writing the rules can be very tedious, especially since the documentation isn't extensive on how the functions provided for these rules work."
"I hope to see improvements in Graylog for more interactivity, user-friendliness, and creating alerts.The initial setup is complex."

ROI

Graylog has proven to be a valuable investment for companies. Users have reported positive outcomes and benefits from implementing Graylog in their systems. The return on investment (ROI) has been described as significant, with users experiencing improved efficiency and effectiveness in their log management and analysis.

Graylog's advanced features and capabilities have allowed users to gain valuable insights and take proactive measures in resolving issues and enhancing security.

Pricing

Enterprise buyers evaluating Graylog often highlight its free open-source version, suitable for smaller needs with a 2GB daily capacity limit. Larger enterprises may find licensing costly, especially when handling significant data volumes. Many utilize the free version due to its extensive features, reserving enterprise licensing for necessary enhancements like improved authentication. Some remain unaware of specific pricing models, favoring the cost-effective community edition for projects, while others prefer enterprise features for robust solutions.

"We are using the free version of the product. However, the paid version is expensive."
"It's open source and free. They have a paid version, but we never looked into that because we never needed the features of the paid version."
"There is an open source version and an enterprise version. I wouldn't recommend the enterprise version, but as an open source solution, it is solid and works really well."

Popular Use Cases

Graylog is primarily used for log aggregation, monitoring, and alerting. Organizations utilize it for central log management, incident analysis, and troubleshooting within container environments. It supports audit trailing for financial systems and helps developers identify issues quickly. With real-time updates, it facilitates analytics via dashboards and extracts metrics from logs. Its capabilities include integrating with security information systems, enriching data through APIs, and visualizing backend services behavior across various sources, benefiting developers and customer support.

Service and Support

Most users have not contacted Graylog's technical support, relying on community forums and documentation instead. Some note that the support is slow and enterprise-focused, with better assistance available for licensed versions. Community support is valued, although the expertise and promptness can vary. For many, forums and online resources are sufficient for troubleshooting. Enterprise support is seen as limited, with users feeling isolated without a license. Community engagement generally receives positive feedback.

Deployment

Many found Graylog's initial setup straightforward, especially with Linux and related tech experience. Kubernetes and Docker setups were mentioned, with some complexity in custom configurations. Some faced challenges without support. Documentation helped reduce complexity. For small environments, the setup was easy, but scalability introduced more complexity. Multi-node configurations involved intricate deployments, such as SSL configurations and cluster setups. Overall, careful planning and some expertise eased the process, while less experienced users faced some hurdles.

Scalability

Many state that Graylog scales well, handling increased devices and team usage. Transitioning to high availability and load balancing shows adaptability. While its scalability is closely tied to Elasticsearch, some find adding nodes complex. Users expand from single to clustered setups with minimal disruption. Cost arises with resource demand, yet handling high message loads and users efficiently is achievable. Deployments recommend cloud solutions for scaling under heavy usage. Some highlight its theoretical scalability in clustered environments.

Stability

Graylog experiences occasional stability issues, mainly during upgrades or when overloading infrastructure. Users mention stability with everyday operations and note resilience in recovery after failures. Graylog generally operates smoothly, managing vast message volumes without outages, though issues such as index rotation and memory exhaustion can occur. Transitioning to high-availability setups is planned by some users to avoid gaps, especially important in IoT. It is rated as stable but not without occasional disruptions under certain conditions.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Graylog Buyer's Guide for additional reliable information.