Graylog Open costs nothing, and that is where many admins stop reading. The questions that follow are the practical ones: is there an ingest limit, what is missing compared with the paid editions, and at what point does the free edition stop being enough? This article answers them from the vendor’s own edition and pricing pages, checked on 27 October 2026. We have not installed or tested Graylog ourselves.
The short answer
Graylog Open is free permanently, not a trial, and the vendor states it has no ingestion cap and no per-user fees. It is source-available under the Server Side Public License (SSPL). For an IT department that needs central log collection, search, dashboards and alerts, it is a complete tool: see our Graylog page. The paid editions, Graylog Enterprise and Graylog Security, add features on top and need a commercial licence. Choose Enterprise for data lake and tiering, SSO and LDAP access, and the correlation engine. Choose Security if you need SIEM functions such as risk scoring and detection content mapped to MITRE ATT&CK.
Graylog Open vs Enterprise vs Security
| Feature | Graylog Open | Graylog Enterprise | Graylog Security |
|---|---|---|---|
| Cost model | Free, no time limit | Paid licence | Paid licence |
| Log collection, pipelines, search, dashboards | Yes | Yes | Yes |
| Alerts | Basic triggers and notifications | Plus correlation engine, advanced notifications, script triggers | Yes, plus detection content |
| Data lake and tiering | No | Yes (hot, warm and archive tiers, selective retrieval) | Yes |
| Access control | Local role-based access | Adds SSO, teams, LDAP-based access, user audit logs | Yes |
| SIEM functions | No | No | Risk triage, anomaly detection, MITRE ATT&CK mapped rules, case creation |
| Sigma rules | Import supported | Yes | Yes, with Graylog-maintained rules |
| API and MCP server | Yes | Yes | Yes |
| Support | Community forums and documentation, no SLA | 24/7 enterprise support | Included with the edition |
| Licensing basis | None | Processed data in the active tier | Processed data in the active tier |
What “free” really means
Three facts from the vendor are worth separating, because they are often blurred:
- No volume limit. Open has no daily ingest cap. You are limited by your own hardware and disk, not by a licence.
- No trial clock. The vendor describes Open as free permanently.
- SSPL, not a classic open-source licence. The vendor notes that offering Graylog as a hosted service to others carries specific SSPL obligations. Running it for your own organisation’s logs is the ordinary case.
Our licence matrix for commercial use shows how Graylog sits next to other free tools.
What you do not get in Open
The gaps are specific. Open has no data lake or tiering, so every retained message lives in your search backend and you manage the disk yourself. SSO and LDAP-based access are listed under Enterprise, which matters once more than a few people use the interface. There is no correlation engine and there are no compliance packs. And there is no vendor support with a service-level agreement: you rely on community forums and documentation.
What you keep is the part most small teams need: collecting syslog and Windows events, parsing them with pipelines, searching, building dashboards and sending alerts.
What the paid editions are licensed on
We do not quote prices here. The vendor says Enterprise and Security are licensed on processed data in the active tier, either by daily volume (starting at 10 GB/day) or by annual consumption (starting at 100 GCUs). Connected sources, users, devices and stored data do not affect the licence, and data sent to the data lake counts only when it is retrieved. In practice the licence follows how much data you actively process, not how many servers you have.
Where Graylog Open runs
The vendor’s installation documentation lists Linux packages (Debian or RPM) and Docker Compose containers as deployment methods, and names the Data Node as the recommended search backend; OpenSearch 1.x is deprecated as of Graylog 7.0 and will be removed in 8.0. The vendor’s edition page also mentions Windows among deployment targets, but the installation page does not list a Windows server package, so check the compatibility matrix for your exact version before you plan a Windows host.
How to choose
- A dozen servers or so, one admin team: Open is enough. Add a retention policy and watch the disk.
- Several teams need their own access, or you need single sign-on: that is the Enterprise feature set.
- You must show auditors detections, risk scoring or compliance reports: look at Security.
- You only read one log file on one machine: you do not need a server at all. LogExpert is a free Windows log viewer, and EventSentry Light covers Windows event monitoring on a small network.
For the wider picture, read our guide to free security and audit log tools.
FAQ
Is Graylog free?
Graylog Open is free, with no time limit, and the vendor states it has no ingestion cap. Graylog Enterprise and Graylog Security are paid.
What are the Graylog free limitations?
Open has no data lake or tiering, no SSO or LDAP-based access, no correlation engine, no SIEM features and no SLA-backed support. Collection, search, dashboards and basic alerts are included.
Is Graylog Open really open source?
It is source-available under the SSPL. Using it for your own logs is the normal case; offering it as a hosted service to others carries extra obligations.
Is there a Graylog free enterprise licence?
The vendor pages we checked do not mention a free Enterprise licence. Open is the free edition.
Is Graylog a SIEM?
Open is a log management platform. SIEM capabilities such as risk triage, anomaly detection and MITRE ATT&CK mapped rules belong to Graylog Security.
Sources: graylog.org edition and pricing pages and the Graylog installation documentation, checked 27 October 2026. Not tested yet by us.
