Graylog: How Graylog works

This documentation is part of the Introduction guide. You can view the complete guide here: Introduction to Graylog, a unified and powerful platform for log management and analytics.

👋 Welcome to Stackhero documentation

Stackhero offers a fully managed Graylog cloud solution designed for speed and simplicity. You can:

• Rely on an unlimited, dedicated SMTP email server included with your service.
• Apply updates effortlessly with a single click, with no manual intervention required.
• Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), providing your team with secure, direct access.
• Benefit from strong performance and security on a private, dedicated infrastructure, with no shared resources or noisy neighbours.

Focus on your data, not your tools: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.

Graylog acts as a central hub between your infrastructure and your team. Log shippers such as Filebeat, Fluentd, rsyslog, or native GELF client libraries collect logs from your systems and forward them to Graylog's input endpoints. Graylog processes each incoming message through configurable pipelines that can parse fields, transform data, enrich events (for example, with geo-IP lookups), and route messages to specific streams.

Processed messages are indexed by OpenSearch (included with Graylog), which powers the search functionality. MongoDB (also included) stores Graylog's configuration: streams, dashboards, users, alerts, and pipeline definitions. Your team uses the Graylog web interface to run ad-hoc searches, build dashboards, configure alerts, and investigate incidents. This provides a unified view of your log data, with sub-second search even at scale.