Graylog

What do you like best about the product?

I like Graylog's problem-solving capabilities that make it easy to find errors and troubleshoot issues quickly. It helps find the root cause by bringing system logs into one place, reducing troubleshoot time, and maintaining system reliability.

What do you dislike about the product?

Graylog can sometimes be complex for beginners. Improving the documentation would really help make troubleshooting much simpler. Providing step-by-step tutorials using real-world examples and comprehensive troubleshooting guides would be particularly useful.

What problems is the product solving and how is that benefiting you?

Graylog centralizes system logs to quickly find errors, troubleshoot issues, and maintain system reliability, reducing troubleshooting time.

What do you like best about the product?

I like how Graylog helps us centralize and analyze logs from our applications. It makes troubleshooting easier, and we can quickly search and investigate problems, which reduces our downtime.

What do you dislike about the product?

The initial setup and configuration can be a bit complex, and the interface could be more intuitive. I think improving the UI and UX would help a lot.

What problems is the product solving and how is that benefiting you?

Graylog centralizes and analyzes logs, making troubleshooting easier and reducing downtime with quick search capabilities.

What do you like best about the product?

Querying massive volumes of log data is remarkably fast, even when searching across multi-terabyte datasets spanning several days or weeks

What do you dislike about the product?

Basic dashboards: Visualization options are limited compared to others

What problems is the product solving and how is that benefiting you?

Siloed logs: Combines server, network, & app logs into single dashboard

What do you like best about the product?

I like Graylog's user-friendly interface, which makes it easy to find everything I need, like search or filter functions, with each component fitting perfectly. I also appreciate its capability as a centralized solution for grouping different types of logs, such as applications on OKE clusters and microservices on EBM traces, while integrating various cloud logs from Oracle and Google. Its design is great, and it offers most of the functionalities we need for monitoring different log types and features for logging solutions.

What do you dislike about the product?

I think Graylog could improve by increasing the built-in integrations. Right now, we're using GitLab, but we're doing it in a legacy integration way. Having a direct integration with GitLab would be great. Also, having more sample integrations available directly within the application would be helpful.

What problems is the product solving and how is that benefiting you?

Graylog helps us monitor logs for performance issues, high memory, CPU usage, and network traffic in Kubernetes clusters. It centralizes logs from different sources like Oracle and Google Cloud, making it easy to find root causes effectively.

What do you like best about the product?

It’s fast when working with small subsets of data over a short period of time. It’s a good fit for near-real-time analytics.

What do you dislike about the product?

price can be expensive, log retention, UI has lots to desire compared to other solutions

What problems is the product solving and how is that benefiting you?

Real-time analytics.

Graylog Enterprise is used primarily for log management and to perform security analytics. It helps the organization collect logs from different sources and centralize them in one place. We can search and analyze events, detect suspicious activity, and it supports security investigations. The organization ingests a lot of logs including firewall logs, AWS, Windows endpoints, and authentication logs. It helps collect everything in a single dashboard, and we can search the logs and monitor each aspect.

Graylog Enterprise collects everything in one dashboard, allowing the SOC team to search the logs and monitor every alert based on the rules, enabling investigation of suspicious activity. For example, if a user account suddenly logs in from an unusual or unauthorized location with multiple failed login attempts, Graylog helps correlate those logs and allows analysts to investigate that quickly.

Graylog Enterprise is used for compliance and audit log retention, for investigation, and it is useful for centralized log collection.

In alerting and correlation, logs are ingested from multiple sources, allowing us to create alerts based on those use cases. For example, if a suspicious IP from an unauthorized location is detected, the IP is checked in the firewall logs, application logs, or whether it has executed some PowerShell script or is showing some authentication behavior. Based on that, everything is correlated, and those insights are available in the tool for SOC analysts to analyze those alerts.

The best feature Graylog Enterprise offers is its centralized log management, allowing analysts to search logs from a single tool instead of checking multiple tools. It is fast, and we can search effectively because during incident response time, the SOC analyst can quickly search a suspicious IP, username, or any IOCs across the historical logs. Another valuable aspect is the alerting and correlation functionality, where alerts can be created for multiple rules based on use cases, such as multiple failed logins, privilege escalation, abnormal authentication behavior, and other security events.

The dashboard and visualization in Graylog Enterprise is good for SOC monitoring purposes.

Graylog Enterprise positively impacts the organization by helping the team and analysts investigate incidents faster since logs from servers, endpoints, cloud, and firewalls are available in one place. Instead of switching between multiple tools, timelines can be reviewed and suspicious activity validated quickly, resulting in faster investigation times, better visibility into logs, and improved incident response capabilities. This has also reduced manual effort and compliance tasks.

Previously, as an SMB company, approximately 40 to 50 alerts per day were generated. When Graylog Enterprise was implemented and evaluated, it correlated everything, providing true positive alerts and reducing the number of alerts to 10, which allows analysts to monitor those true positive alerts and take action accordingly.

Graylog Enterprise performs well overall; however, the UI could be improved because the SOC team creates multiple dashboards based on their use cases, and creating dashboards is complex. If there were multiple dashboard and chart styles available, it would be helpful for the team and for the SOC analysts to investigate and use the UI in a better way.

I have been working as a cybersecurity engineer for six years.

Enterprise-grade platforms like Graylog Enterprise are expected to be stable for security purposes as well as monitoring workloads, and the experience has been good.

Graylog Enterprise is designed to be capable of handling growing workloads effectively.

The support experience generally depends on the issue complexity, but the team was very responsive and their technical guidance was also very good and constant. I would rate the customer support around nine out of ten.

Previously, Elasticsearch, an open-source SIEM tool, was used, and multiple monitoring approaches were evaluated depending on maturity and requirements.

Graylog Enterprise is a security product and generally requires an evaluation. Multiple tools were evaluated, and the solution will need to be scaled if required, as the main cost depends on integration and operation requirements. These details will be shared with leadership, and they will make the decision.

Graylog Enterprise was purchased from a Graylog salesperson, a third-party salesperson.

Instead of having five analysts working, Graylog Enterprise has reduced the number of analysts as well as time, resulting in a decreased cost of 20%. It has provided better quality and improved detection capabilities.

The organization often compares Graylog Enterprise with other SIEM and detection solutions tools based on the integration, and it is upon leadership's decision.

If others are looking into using Graylog Enterprise and have multiple log sources that they need to monitor and correlate, I would recommend Graylog Enterprise. It is a good product, allowing them to ingest all the logs into a single platform where they can search, triage, create rules, and monitor every alert.

Graylog Enterprise is a good, secure SIEM platform with mature investigation capabilities that works best when integrated into multiple log sources. I rate this product an eight out of ten.

On-premises

Amazon Web Services (AWS)

What do you like best about the product?

Graylog 7.1 feels like a solid upgrade from a SOC engineering perspective. The biggest improvement for me is the collector experience,it’s now much easier to get logs flowing without the usual Sidecar-heavy setup overhead. That added flexibility speeds up onboarding for new systems and cuts down on configuration friction in day-to-day operations.

Overall, it comes across as more lightweight and more practical, and it seems better suited for fast-moving environments where you just want data in and visibility quickly.

Graylag has also been a great tool for investigations in my experience, especially when I’m digging through logs and tracing activity during analysis. I’m currently exploring the new collector’s beta features in the lab, and I’m excited to eventually test the upgrade in production environments as well.

What do you dislike about the product?

Graylog provides a strong and flexible platform for centralized log management and pipeline-based message processing. The overall stream and routing capabilities are powerful and well suited for SOC environments.

One area that could further enhance operational efficiency would be improved alerting and visibility around platform state and ingestion workflows. Notifications for stopped streams, pipeline processing failures, and Sidecar health issues would help reduce troubleshooting time and improve reliability during day-to-day operations.

In environments where rapid log ingestion and correlation are critical, proactive operational alerts would add significant value by helping teams identify configuration or workflow issues earlier, before they impact investigations or monitoring coverage.

What problems is the product solving and how is that benefiting you?

Graylog stands out for its affordability and provides a powerful layer for log analysis, enabling faster and more efficient investigations. It simplifies troubleshooting by centralizing logs and improving visibility, which helps teams quickly identify and respond to issues.

What do you like best about the product?

I really like Graylog for several reasons. It is easy to set up and manage, which I really appreciate because it makes it quickly operational. The interface is simple and efficient, with filters that allow you to easily find the necessary logs. The ability to easily add new servers by configuring Graylog as the log destination is a plus, as the logs are immediately forwarded. I also appreciate the volume-based licensing which allows us to only pay for what we need, and it encourages us to optimize our logs if necessary to not exceed the limit. Finally, switching from Rsyslog to Graylog has been beneficial because Graylog is better in terms of display and management, and the initial installation was super easy and fast.

What do you dislike about the product?

In the future, perhaps integrate an AI agent that will fetch the desired logs for us with a simple prompt, like 'Fetch me the unauthorized access logs on server X'. Just that, an AI agent that helps the user display specific information like 'Show me the logs of denied access by all my servers that start with PRV'.

What problems is the product solving and how is that benefiting you?

I use Graylog to monitor and centralize our logs in real-time, which is crucial for security. The intuitive interface makes it easy to search and analyze logs, and the volume-based licensing suits our needs, reducing costs.

What do you like best about the product?

Logs from all our systems can be easily and quickly searched through. Alerting based on matched logs is also a huge benefit.

What do you dislike about the product?

The search feature isn't straight-forward, it requires learning the little in's and out's of how the search is meant to be used.

What problems is the product solving and how is that benefiting you?

Aggregating logs into a place where we can easily search them and receive notification about logs that we'd like to keep an eye on