TrustRadius: an HG Insights company

Graylog

Score7.6 out of 10

30 Reviews and Ratings

Get a Demo

What is Graylog?

Graylog, headquartered in Houston, offers their eponymous platform for centralized log management that helps users find meaning in data faster so as to take action immediately. Graylog is available via Enterprise and Cloud plans, but also has a Small Business Plan, and an Open (free) plan with limited features.

Categories & Use Cases

Reviews

What users are saying about Graylog.
View all reviews

Graylog can compete against the big boys.

Incentivized
Jeremy Cejka
Principal Systems Engineer in Information Technology at Research Innovations (51-200 employees employees)

Pros

  • Log Aggregation pipeline
  • Dashboards

Cons

  • Pricing for Enterprise is a bit unrealistic.
  • Archiving should be a standard feature in the community edition.

Return on Investment

  • Full return on investment for the free version.
  • Paid features aren't fully justifiable at the enterprise cost.

Alternatives Considered

IBM QRadar, Splunk Enterprise Security, AlienVault OSSIM and AlienVault USM

Other Software Used

Palo Alto Networks Next-Generation Firewalls - PA Series, Palo Alto Networks GlobalProtect Mobile Security Manager, Palo Alto Networks URL Filtering PAN-DB

Useful and free SIEM tool

Incentivized
Verified User
Professional in Information Technology (11-50 employees employees)

Use Cases and Deployment Scope

Allows insight into logs from various systems and products that would otherwise be time consuming to access and identify. Dashboards can be customised to your preferences and Alerts/emails can be defined when specific events or patterns occur, which is not possible directly from the log source. Our use case is primarily security related looking at access/sign-in logs from various platforms and then sending alerts as required.

Pros

  • Ingesting various log sources
  • Dashboards - Customisable
  • Event alerts/emails

Cons

  • Support for more log sources
  • Event alerts/emails - Some cases where unable to separate data from multiple clients, and no easy fix
  • API - Limits results to 10,000 and can cause server to lockup on queries that exceed the limit

Most Important Features

  • Multiple log sources
  • Customisable Dashboards
  • Event alerts/emails

Return on Investment

  • Able to offer monitoring services to new and existing clients to increase revenue
  • Staff have increased billing percentage
  • Potential to expand security services

Other Software Used

M‑Files, Microsoft Azure Active Directory, Windows Server

Clean, robust and intuitive central logging

Incentivized
Verified User
Team Lead in Information Technology (501-1000 employees employees)

Use Cases and Deployment Scope

We have more than 60 applications, ranging from websites, Winforms, windows services, API's and console executables. All of them need to log their tracing and/or error information to a central location. It needs to be central because you don't want to search for this location, especially when you only have 5 minutes to solve a problem. We used to have a dedicated database for logging, but this does not eliminate the time lost searching for "the" logs. Also, [the] configuration used to be a manual and self-made business that wasn't always clear. Graylog is a dedicated logging solution that comes "out of the box" and is made accessible through a well-known plugin architecture (log4net if you're developing with the .NET framework).

Pros

  • Nice search interface and powerful search options
  • JSON extractor to "extract" variables and values from JSON input.
  • Clear and intuitive dashboards

Cons

  • In the front end, the search "tricks" could have been made a little easier to find. There seems to be some kind of "search language" where you can use keywords like "AND" and "OR," etc. (much like SQL language). But it's totally unclear what does work and what doesn't. If you don't know that it's there, you'll never find it. Of course, after you do know it, you can find many examples online on how to use it.
  • The backend is not for the inexperienced. Graylog is based on elastic search and MongoDB. And it's Linux. This means that Graylog is actually 3 applications that you need to configure in a Linux environment. This means that you need quite some experience to get this running. Fortunately, though, things are kept as simple as possible. What I mean is that at first, the task seems daunting, but then you'll find that there's not much to it after all.
  • We've had multiple occasions that disk size was full or indexes went larger than allowed. When this happens, the systems can become corrupt. The solution is to just delete the indexes, but it took quite some time to find this out.
  • We disabled "Automatic updates" on the Linux server because unattended updates always lead to problems. This is not a real problem, or solely related to Graylog, but worth mentioning. Updates are best handled manually.

Most Important Features

  • Central (the fact that it's central), one place to log them all
  • Multiple ways to log, one I already mentioned (log4net)
  • AD support
  • The fact that it's free

Return on Investment

  • Negative: None. There is no negative impact by using Graylog.
  • Speed of solving bugs. Logging is so accessible and easy to search that we spend a lot less time [searching] for specific errors.
  • Better health of applications. Since monitoring the logs is so easy, it's very easy to keep an eye on the tracing to see if things are going smoothly and according to plan.

Alternatives Considered

Azure Monitor

Other Software Used

Azure API Management, Azure Blob Storage, Azure Data Factory

Graylog, Free Vs. Paid

Incentivized
Verified User
Consultant in Information Technology (201-500 employees employees)

Pros

  • The free edition is extraordinarily powerful.
  • Log searching is quick.
  • The web interface is sleek, and the install is relatively quick.

Cons

  • Rotating the indexes are hard! It is also easy to brick your deployment. Purchase support, but it's so ludicrously expensive, that I'd go with a different vendor.
  • Community support dances around questions and points to documentation, which is there, but is not always accurate.
  • Searching logs uses logic that is not always easy to use.
  • There is not a good way to size how much space you need for a given log retention. It also does not tolerate running out of space using a smart feature or such to auto delete. The heap can also overflow.
  • It uses MangoDB instead of a different database.
  • The OVA is not approved for production use.
  • It is resource intensive.

Return on Investment

  • Graylog has allowed our clients to successfully log NAT translations and comply with the DMCA, protecting us in terms of Safe Harbor.
  • Graylog allows us to have a central server for syslog, which saves time rather than checking each machine, or figuring out events if we experience a unresponsive failure, lowering downtime.
  • We have also spent a lot of time learning Graylog, which was a considerable investment. However, it is now starting to pay its dividends.

Alternatives Considered

Splunk Enterprise and AlienVault USM

Other Software Used

Microsoft Teams, Microsoft 365 Business, Windows Server

Liven up your logging with Graylog!

Incentivized
Verified User
Administrator in Engineering (1001-5000 employees employees)

Pros

  • The ability to add and remove information to the messages. This makes it so you can customize each message and get the information you really want.
  • Being able to search for different criteria allows finding the exact data you want without having to manually filter the data.
  • Searching tends to be quick and is able to process large amounts of data quickly so you don't have to wait forever for your data.

Cons

  • The graphs and visualizations are limited on the dashboard if there were more options it would be better for different kinds of data.

Return on Investment

  • Graylog is just less expensive than some other options which meant it fit into our budget otherwise we might not be able to justify a higher cost.
  • Being able to track issues that we normally couldn't track using other tools is a bonus to help us know of any issues we have and can fix before an outage or failure that could potentially cost money.
  • We have had to spend more time than I would like to understand and customize Graylog which has taken time away from other tasks and projects.

Alternatives Considered

Splunk Enterprise

Related Products

Products similar to Graylog that may also meet your needs.
All comparisons
Splunk Enterprise
CompareLearn more
Datadog
CompareLearn more
IBM Security QRadar SIEM
CompareLearn more
Logz.io
CompareLearn more