Graylog is a centralised log management platform built for the case where several dozen systems are writing to the same place and you still need to find one line from 03:12 last Tuesday. Collectors and applications ship their logs over a network protocol, the server parses and routes them, and the result lands in a searchable store with retention rules, alerts and dashboards on top. It has been in production since 2011, is written in Java, and the free edition — Graylog Open — is aimed squarely at teams who want a syslog and GELF estate without paying per gigabyte of ingest.

Inputs and processing

Messages arrive through named inputs rather than a single fixed pipe. GELF (Graylog’s own structured JSON format) is available over UDP, TCP and HTTP; syslog is accepted over UDP and TCP, including the CEF and RFC 5424 variants; Beats/Filebeat can connect directly on port 5044; and Kafka, AMQP and raw UDP/TCP inputs cover brokers and legacy senders. Each input is bound to a port and can carry its own extractors, so a message is normalised into fields at the edge instead of on the search side.

Routing happens through streams: rules match on field values and send a message into one or several streams, which in turn map to index sets. Pipelines add a rule language for rewriting fields, dropping noise, looking up enrichment data or raising events, and the stage order is explicit rather than implied by configuration file order. A Sidecar process can manage Beats collectors across hosts from the web interface, which is what keeps a large fleet from becoming a pile of hand-maintained YAML.

Search, dashboards and alerting

Search uses a Lucene-style query syntax over the extracted fields — source:db01 AND level:ERROR, relative time ranges, then a histogram and message table that can be saved as a view or pinned to a dashboard. Aggregations and charts are built from the same query, so a panel is a saved search rather than a separate reporting product. Event definitions run on a schedule against a query and fire notifications to email, Slack, PagerDuty, HTTP webhooks or a custom command, which is the part that turns a log store into an alerting system.

Architecture and scale

A working installation is three moving parts: the Graylog server itself, a MongoDB instance that holds configuration metadata (inputs, streams, users, dashboards — not the log data), and a search backend that stores the messages. The repository carries storage modules for OpenSearch 2, OpenSearch 3 and Elasticsearch 7, and the bundled data-node package ships a pre-configured search node so a single-node install does not need a separate Elasticsearch deployment to assemble by hand. Messages that arrive while the search backend is unavailable are written to an on-disk journal and replayed afterwards, which is what stops a backend restart from losing the messages sent during it. For larger deployments the server runs as several nodes behind a load balancer, each with its own journal, and the web interface is served on port 9000 by default.

The licence caveat

Graylog is source-available, not open source. The server repository states that Graylog is released under version 1 of the Server Side Public License (SSPL), the MongoDB-drafted licence that requires anyone offering the software as a service to release the source of the whole service stack. It is not OSI-approved, which is why this listing is classified source-available rather than open source. Reading, modifying and self-hosting Graylog Open costs nothing. Graylog also sells Enterprise, Security and Cloud editions on top, with features such as long-term archival, audit trails and centralised management kept out of the free build; the open core is genuinely usable, but the commercial editions are where the vendor makes its money.

Who it suits

Teams that need a searchable log estate with real alerting, and are willing to run a JVM server plus a search cluster to get it. Single-node homelab installs work and the bundled data-node keeps them simple, but Graylog assumes a server and a heap: this is not a tool you drop into a 1 GB container and forget. If the SSPL is a problem for your distribution or your product, the alternatives below are the usual substitutes.

Alternatives

• Grafana Loki — AGPL-3.0 log aggregation that indexes labels instead of text, far cheaper to run for high-volume streams, queried with LogQL inside Grafana.
• OpenSearch — Apache-2.0 search and analytics engine, the piece Graylog itself stores messages in; you can build the log store directly on it with Dashboards for the interface.