Graylog: Centralized Log Management

Graylog: Centralized Log Management

By How we write our guides

Graylog collects logs from every machine and service you run into one searchable place, with parsing, dashboards, and alerting on top.

Why self-host Graylog

Logs are useless spread across twenty machines and invaluable in one searchable index. Hosted log platforms price by ingestion volume, which gets expensive quickly and quietly encourages you to log less than you should. Self-hosting moves the cost to storage you control, and keeps log data, which routinely contains sensitive information, inside your own network.

What it does

Graylog falls into the Monitoring category of self-hosted software. It ingests logs over syslog, GELF, Beats, and HTTP, parses unstructured messages into structured fields with extractors and pipeline rules, indexes them in OpenSearch or Elasticsearch, and provides a search interface built for investigation rather than tailing. Dashboards, saved searches, threshold and correlation alerting, role-based access control, and archiving to cold storage round it out.

Community traction

Graylog is one of the established names in open-source log management alongside the ELK stack, widely deployed in enterprises and by security teams building detection on top of centralized logging.

Deployment

Graylog needs three components: Graylog itself, MongoDB for configuration, and OpenSearch or Elasticsearch for the log index. Docker Compose is the usual deployment. Be realistic about resources: OpenSearch wants substantial memory, and this is not a lightweight addition to a small homelab host.

Alternatives

The ELK or OpenSearch stack with Kibana covers the same ground with more assembly required. Loki with Grafana is dramatically lighter and indexes labels rather than full text. For a small setup, Loki is often the better fit; Graylog earns its weight at scale and for security use cases.

License

Graylog Open is released under the Server Side Public License, with enterprise features under a separate commercial licence.

Graylog makes sense once “which machine was that error on” has cost you an afternoon.

Related self-hosted apps

OpenObserve: Logs, Metrics, and Traces in a Single Binary With Cheap StorageAn observability platform for logs, metrics, traces, and real user monitoring that stores data as compressed Parquet on local disk or S3, queried with SQL and PromQL. A lightweight alternative to Elasticsearch and Datadog. AGPL-3.0.Prometheus: Metrics Collection and Time-Series DatabaseA monitoring system that scrapes metrics from instrumented targets on an interval, stores them as time series, and evaluates alerting rules with a powerful query language.SigNoz: OpenTelemetry-Native Observability for Traces, Metrics, and LogsAn open source alternative to Datadog and New Relic that collects traces, metrics, and logs through OpenTelemetry and stores them in ClickHouse, with APM dashboards, alerts, and correlation between signals.Wazuh: Open Source SIEM and Host Intrusion DetectionAgents on each machine collect logs, monitor file integrity, check configuration against benchmarks, and detect intrusions, reporting to a central server with dashboards and alerting.

Browse all self-hosted apps →