prevously we using syslog server to centralize log, and when we have more server and network we can not put all those log into syslog server that store data in mysql, it perform slow search and not report correctly, i have try spend sometime to search and i found graylog, i try to setup a few day until success because its new related to elastic search, but finally i find out and keep using until now, its around 3 years already since i use graylog server to monitor all the network activity, monitoring server with nxlog agent, monitor cisco switch with syslog, linux with syslog, and can monitor the radius authentication log, each time users plug the network or connect wifi log generated and sent to graylog-server, and graylog server create alert message send by telegram to system admin.

- Graylog is very powerful log, i have search around 50million of record in 3second only, very powerful log because it integrated with elastic search that perform log search very fast. - Telegram alert notification is what i like, i create the rule to let it send notification to telegram so i know what is going on on the network/server log. - enterprise license are free for one year, and make sure your traffic log not hit to 5GB/day. - support various log protocol, nxlog from windows, syslog from linux, and other such as aws. but i use only nxlog and syslog only.

its perfect already but the dashboard not so nice, not so flexible on the reporting yet.

Graylog has been great to work with. Their sidecar implementations make client configuration and management very easy, and even with the free version, they provide reliable, albeit limited support (I’ve gotten good, live email replies to a couple of questions, versus only allowing you to access forums, etc).

Very low cost of ownership, particularly if you can get the Community (Free, Open-Source) version to meet your needs. I’ve implemented Graylog at multiple organizations for only the cost of hardware / storage.

Would love to have more plugins / content packs available in the Graylog Marketplace. With limited hands on a team for a smaller company, there’s often not enough time to write extractors and content packs.

Its easy to use and deploy. We have installed it over centos and its easy to deploy and start working on.

The customer support structure needs to improve, we have been facing unknown issues for which rca was needed however there have been issues. The streams were showing running but they were struck. Also option should be there to easily search logs

I’ve recommended it as a solution to many local governments during my conference presentations and they’ve listened.

Graylog is built on ElasticSearch and extends its functionality out into a great product with the System Administrator in mind. You stand up the platform, point logs at it and the rest is up to your internal processes. I also enjoy that the vast majority of intelligence and augmented data is built directly into the platform rather than an outside product. The community support forums are chock full of helpful folks.

For a long time the visualizations were quite lacking and we required additional tools to properly tell our data stories but this is improving drastically with each new release.

Experience has been great, we started by using the free version, it has provided benefits early on to the dev teams to search through web logs without the need for downloading them and using a log parser application, or committing early to expensive paid tools. Since then we keep adding new sources and are looking at more enterprise features as usage grows.

Graylog has alot of flexibility and a mature feature set. We use it across all of our Windows as well as Linux servers. It has a strong community and alot of flexibility, does not impose restrictions on our applications, good documentation and generally receives regular updates and features.

I find some of the latest changes to the GUI (changes happen all the time with Graylog) are less user friendly - functionality to get count tables are still there but it is less dummy proof whereas before a novice user could click around in the side navigation and discover certain features. There are also less cloud offerings for Graylog so it fits more the on-premise model where you manage the graylog server/infrastructure.