Graylog: How Graylog works

This documentation is part of the Introduction guide. You can view the complete guide here: Introduction to Graylog, everything you need to know.

👋 Welcome to the Stackhero documentation!

Stackhero offers a ready-to-use Graylog cloud solution that provides a host of benefits, including:

• Unlimited and dedicated SMTP email server included.
• Effortless updates with just a click.
• Customisable domain name secured with HTTPS (for example, https://logs.your-company.com).
• Optimal performance and robust security powered by a private and dedicated VM.

Save time and simplify your life: it only takes 5 minutes to try Stackhero's Graylog cloud hosting solution!

Graylog acts as a central hub between your infrastructure and your team. Log shippers — Filebeat, Fluentd, rsyslog, or native GELF client libraries — collect logs from your systems and forward them to Graylog's input endpoints. Graylog then processes each incoming message through configurable pipelines that can parse fields, apply transformations, enrich events with geo-IP data or lookup tables, and route messages to the correct streams.

Processed messages are indexed by OpenSearch, which is bundled with Graylog and handles the full-text search workload. MongoDB, also included, stores Graylog's configuration — streams, dashboards, users, alert rules, and pipeline definitions. Your team accesses everything through Graylog's web interface, where they can run ad-hoc searches, build dashboards, configure alerts, and investigate incidents. This provides a unified view of all your logs, with sub-second searches even at scale.