Graylog: Introduction
Intruduction to Graylog, a unified, powerful platform for log management and analytics
👋 Welcome to Stackhero documentation
Stackhero provides a fully managed Graylog cloud solution designed for speed and simplicity. You can:
- Rely on an unlimited, dedicated SMTP email server included with your service.
- Apply updates effortlessly with a single click, with no manual intervention needed.
- Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), giving your team secure, direct access.
- Experience strong performance and security on a private, dedicated infrastructure with no shared resources or noisy neighbors.
Focus on your data, not your tooling: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.
What is Graylog
Graylog is an open-source log management platform that centralizes log collection, storage, search, and analysis for your entire infrastructure. Instead of connecting to individual servers to manually inspect logs, you can ship all logs to Graylog, which indexes them in real time. Every log becomes instantly searchable, even across billions of events, with results returned in milliseconds.
Graylog delivers three key capabilities. It collects log data from almost any source: servers, applications, containers, network devices, or cloud services, using widely adopted protocols such as Syslog, GELF, Beats, raw TCP/UDP, and HTTP. It then indexes this data using an embedded OpenSearch engine, making every field immediately queryable. Finally, it analyzes your data through a web interface with full-text search, customizable dashboards, alerting, and real-time processing pipelines that can enrich, filter, and route events as they arrive.
The company behind Graylog
Graylog was created in 2010 by Lennart Koopmann in Hamburg, Germany, initially as a personal tool for centralized log management. The project was open-sourced in 2012 under the name GELF (Graylog Extended Log Format), and quickly became popular in the DevOps and infrastructure communities. Graylog, Inc. was later founded to build commercial offerings around the open-source core.
Today, the company is headquartered in Houston, Texas, with offices in London and Hamburg. It has received significant venture funding and supports thousands of organizations worldwide, from startups to large enterprises and government agencies.
What is Graylog used for
Engineering and operations teams use Graylog for a variety of scenarios. The most common is production debugging: when issues arise, teams can search across logs from dozens of services at once, instead of manually inspecting files on each server. This makes troubleshooting much faster and more effective.
Graylog is also used for infrastructure monitoring. You can define alert conditions that trigger when error rates increase, services become unreachable, or unusual log patterns are detected. Security teams rely on Graylog for audit and compliance, tracking authentication events, access patterns, and anomalies, while retaining logs for periods required by standards such as GDPR, ISO 27001, SOC 2, and HIPAA. Platform teams use Graylog to correlate events across diverse systems: web servers, databases, load balancers, or Kubernetes pods, into a single, searchable timeline.
How Graylog works
Graylog acts as a central hub between your infrastructure and your team. Log shippers like Filebeat, Fluentd, rsyslog, or native GELF client libraries collect log data from your systems and forward it to Graylog's input endpoints. Graylog processes each incoming message through configurable pipelines that can parse fields, transform data, enrich events (for example, with geo-IP lookups), and route messages to specific streams.
Processed messages are indexed by OpenSearch (bundled with Graylog), which powers the search functionality. MongoDB (also bundled) stores Graylog's configuration: streams, dashboards, users, alerts, and pipeline definitions. Your team works through Graylog's web interface to run ad-hoc searches, build dashboards, set up alerts, and investigate incidents. This creates a unified view of your log data, with sub-second search even at scale.
Is Graylog free
Graylog is available in two editions. Graylog Open is the community edition: free to use, including in production, with support for core log management features such as collection, indexing, search, dashboards, streams, pipelines, and basic alerting. The source code is available on GitHub. Graylog Operations and Graylog Security are commercial editions that offer advanced features like anomaly detection, compliance reporting, advanced correlation, and enterprise support.
A key licensing note: In 2023-2024, Graylog switched its core license from Apache 2.0 to the Server Side Public License (SSPL). For most users: companies running Graylog internally, this change has no practical impact. You can continue to use Graylog Open for free. The SSPL mainly affects those who want to offer Graylog as a hosted service to third parties. If you require the Apache 2.0 license, the last release under it was Graylog 5.0. Versions 5.1 and later use SSPL. For more detail, you can review the official SSPL license documentation.
When to use Graylog
Graylog is ideal when you need to centralize logs from multiple servers, services, or applications into one searchable interface. If your team is spending time connecting to machines to debug production issues, or if you lack real-time visibility into your infrastructure, Graylog addresses these challenges directly.
It is a strong choice when you require real-time alerting on log patterns: such as error spikes, failed authentication, or service outages, or when retention for compliance and audit is important. Teams seeking a dedicated log management UI, without the overhead of piecing together multiple tools, will find Graylog especially effective.
When not to use Graylog
Graylog is specialized for log management. If your main requirement is storing and querying time-series metrics (such as CPU usage, request latency, or memory consumption), a time-series database like InfluxDB or Prometheus is a better fit. Graylog is designed for log events, not for high-frequency numerical measurements.
What makes Graylog so great
Graylog provides several advantages over building your own log management stack:
- All-in-one solution: OpenSearch and MongoDB are bundled and pre-configured. You do not need to install, integrate, or maintain separate services.
- Fast, intuitive search: Full-text search across billions of events in milliseconds, using the Graylog Query Language (GQL) that is easy to learn.
- Real-time streams and pipelines: Route and transform log data as it arrives. You can filter noise, enrich data, and direct specific events to specific streams without custom coding.
- Integrated alerting: Alert conditions and notifications via email, Slack, PagerDuty, and other channels are built in: no separate alerting system required.
- Native dashboards: Build interactive dashboards directly in the Graylog web UI, without needing extra visualization tools like Grafana or Kibana.
- Multi-protocol log ingestion: Accept logs via Syslog, GELF, Beats, raw TCP/UDP, HTTP, and more. Graylog works with nearly any log shipper your environment already uses.
What is Graylog cloud
Graylog cloud refers to a managed Graylog deployment delivered by a cloud provider, instead of running it on-premises. Self-hosting Graylog means operating three services: Graylog, OpenSearch, and MongoDB, and keeping them updated, backed up, and secure can be a significant operational burden.
With Stackhero, you get a dedicated Graylog instance ready within minutes. OpenSearch and MongoDB are included and configured automatically. Your instance runs on isolated infrastructure, ensuring your log data stays private. All connections are encrypted with TLS 1.3, backups are performed every 24 hours and retained for up to 3 months, and updates are one click away. You can deploy servers in the United States or Europe, and hourly billing ensures you pay only for what you use.
How to start Graylog
If Graylog fits your project needs, you might want to try a managed instance that is pre-configured and ready to use in just a few clicks. You can launch a free demo instance in about 2 minutes and explore Graylog without setup overhead. Upgrading to a production-ready instance is just as straightforward.