Graylog is an open-source, self-hosted log management platform that puts a complete operations and security workflow on top of an Elasticsearch or OpenSearch backend. Where raw Elasticsearch gives you an index and a query API, Graylog adds the parts a team actually needs to run logs day to day: managed inputs, parsing pipelines, saved searches, dashboards, alerting, role-based access, and archival - all configured through a web UI rather than assembled by hand. It is the open alternative teams reach for when a Splunk license is out of budget but they still want a self-contained log platform.

Inputs, streams, and pipelines

Logs arrive through inputs - Syslog, GELF (Graylog's own structured format), raw TCP/UDP, Beats, or Kafka. As messages come in, Graylog routes them into streams by rule (for example, everything from the payment service into a "payments" stream), and streams are the unit that dashboards, alerts, and permissions attach to. Parsing and enrichment happen in pipelines: ordered stages of rules written in a small expression language that extract fields, drop noise, or geolocate IPs before the message is stored.

rule "extract status and flag server errors"
when
  has_field("message")
then
  let m = grok(
    pattern: "%{IPORHOST:clientip} .* \"%{WORD:method} %{URIPATH:path}.*\" %{NUMBER:status:int}",
    value: to_string($message.message)
  );
  set_fields(m);
  set_field("is_server_error", to_long($message.status) >= 500);
end

Search and alerting

Search uses a Lucene-style query syntax (status:500 AND path:/checkout) over the configured backend, scoped to a stream and time range. Alerts (event definitions) run a saved search on a schedule or as a continuous aggregation and fire a notification when a condition is met - more than N server errors in five minutes, or a login from a new country. Because everything is self-hosted, retention and storage cost are yours to control through index rotation and archiving, which is the main reason organizations with steady high log volume pick it over per-gigabyte SaaS pricing.

Frequently asked questions

What sits underneath Graylog? Elasticsearch or OpenSearch for the search index, plus MongoDB for configuration and metadata. Graylog adds inputs, streams, pipelines, dashboards, alerting, and access control on top.

What is a stream? A rule-defined category of incoming messages (by source, service, or content). Dashboards, alerts, and permissions all attach to streams, making them the central organizing unit.

What are pipelines for? Ordered rule stages that parse, enrich, redact, or drop messages at ingest - extracting structured fields from raw text before storage.

Why choose Graylog over a SaaS log tool? It is self-hosted and open source, so storage and retention cost are controlled directly rather than billed per ingested gigabyte - attractive for steady high-volume logging.

See the monitoring & logging overview and compare with Splunk.