Graylog: How Graylog works

This documentation is part of the Introduction guide. View the full guide here: Intruduction to Graylog, a unified, powerful platform for log management and analytics.

👋 Welcome to Stackhero documentation

Stackhero provides a fully managed Graylog cloud solution designed for speed and simplicity. You can:

• Rely on an unlimited, dedicated SMTP email server included with your service.
• Apply updates effortlessly with a single click, with no manual intervention needed.
• Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), giving your team secure, direct access.
• Experience strong performance and security on a private, dedicated infrastructure with no shared resources or noisy neighbors.

Focus on your data, not your tooling: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.

Graylog acts as a central hub between your infrastructure and your team. Log shippers like Filebeat, Fluentd, rsyslog, or native GELF client libraries collect log data from your systems and forward it to Graylog's input endpoints. Graylog processes each incoming message through configurable pipelines that can parse fields, transform data, enrich events (for example, with geo-IP lookups), and route messages to specific streams.

Processed messages are indexed by OpenSearch (bundled with Graylog), which powers the search functionality. MongoDB (also bundled) stores Graylog's configuration: streams, dashboards, users, alerts, and pipeline definitions. Your team works through Graylog's web interface to run ad-hoc searches, build dashboards, set up alerts, and investigate incidents. This creates a unified view of your log data, with sub-second search even at scale.