Graylog: How Graylog works

This documentation is part of the Introduction guide. You can view the complete guide here: Introduction to Graylog, everything you need to know about it.

👋 Welcome to the Stackhero documentation!

Stackhero offers a ready-to-use Graylog cloud solution that provides a host of benefits, including:

• Unlimited and dedicated SMTP email server included.
• Effortless updates with just a click.
• Customizable domain name secured with HTTPS (for example, https://logs.your-company.com).
• Optimal performance and robust security powered by a private and dedicated VM.

Save time and simplify your life: it only takes 5 minutes to try Stackhero's Graylog cloud hosting solution!

Graylog acts as a central hub between your infrastructure and your team. Log shippers — Filebeat, Fluentd, rsyslog, or native GELF client libraries — collect log data from your systems and forward it to Graylog's input endpoints. Graylog then processes each incoming message through configurable pipelines that can parse fields, apply transformations, enrich events with geo-IP data or lookup tables, and route messages to the appropriate streams.

Processed messages are indexed by OpenSearch, which is included with Graylog and handles the full-text search workload. MongoDB, also bundled, stores Graylog's configuration — streams, dashboards, users, alert rules, and pipeline definitions. Your team accesses everything through Graylog's web interface, where they can run ad-hoc searches, build dashboards, configure alerts, and investigate incidents. This provides a unified view of all your log data, with sub-second search even at scale.