When something breaks across a dozen servers, the answer is usually in the logs — on whichever machine you have not checked yet. Graylog collects logs from everything you run into one place, indexes them, and lets you search them in seconds instead of grepping your way across the estate.
Graylog Open is the free edition, made by Graylog, Inc. The current stable version is 7.1.9 (September 2026). It is a serious piece of infrastructure rather than a program you install on a workstation — plan a server for it.
Graylog Open at a glance
| Latest stable version | 7.1.9, September 2026 |
|---|---|
| Paid editions | Graylog Enterprise and Graylog Security |
| Licence | Free (source-available, SSPL); paid Enterprise and Security editions |
| Supported systems | Debian 12; Ubuntu 22.04 and 24.04; RHEL, AlmaLinux, Rocky 8 and 9; SLES 15; also Docker |
| Required components | Graylog server + Data Node (the search backend) + MongoDB 7.x–8.2 |
| Support | Community forums; paid support comes with Enterprise |
What it does
- Collects logs from Linux and Windows servers, network devices, containers and cloud services — syslog, Windows events, Kubernetes and more.
- Search in real time, with a guided query builder for people who do not write queries daily.
- Dashboards that show error rates, failed logons or whatever you decide matters.
- Alerts on thresholds and events, delivered to email, Slack or PagerDuty.
- Processing pipelines that parse, enrich and route messages as they arrive.
- Sigma rules can be imported, which is how you reuse public detection content.
- REST API for everything, so Graylog fits into existing automation.
What Graylog Open does not include
The free edition is a full log management system. The paid editions add:
- Built-in data lake, parallel archive restore and archiving to Azure Blob Storage
- 24/7 vendor support
- Security features: SIEM and user-behaviour analytics, risk scoring, automated investigations, correlation rules, compliance packs and audit reporting
For an IT department that wants searchable logs and alerts, Open is enough. For a security operations centre with compliance obligations, it is not.
Installation in outline
- Click the Download button at the top of this page and unpack the archive, or use the vendor’s package repository for your distribution.
- Install MongoDB 7.x or newer — it stores configuration, not log data.
- Install the Data Node, which is the search and storage backend. Running your own OpenSearch instead is still possible but is being phased out.
- Install and configure the Graylog server, then open the web interface and create your first input — syslog on UDP 514 is the traditional start.
- Point one server at it, confirm messages arrive, and only then roll out to the rest.
Docker images and a Compose file are available if you prefer containers.
Planning the hardware
Graylog publishes no fixed minimum, only guidance that is worth following:
- Disk for the journal: three to five times your daily log volume, on SSD.
- Disk for the index: daily volume × retention days × 1.2.
- Memory: give each service a Java heap of about half the available RAM, never more than 31 GB.
In practice: a small office sending a few gigabytes a day needs a virtual machine with several cores, 16 GB of RAM and fast storage. Underestimating the disk is the classic mistake.
Common problems and version traps
| Problem | What to do |
|---|---|
| OpenSearch 3.0 or newer installed | The vendor states plainly: do not install or upgrade to OpenSearch 3.0+, it is not supported. |
| Still on OpenSearch 1.x | Deprecated in Graylog 7.0 and removed in 8.0 — migrate to the Data Node before upgrading. |
| MongoDB older than 7.x | Not supported by Graylog 7.x; upgrade MongoDB first. |
| Disk fills up quickly | Set retention by index size and time, and check the journal size before it becomes the problem. |
| Messages arrive but nothing is searchable | Usually the index rotation or the stream rules — check that the input is attached to the default stream. |
Graylog vs. alternatives
| Tool | How it compares |
|---|---|
| Elastic Stack with Kibana | More flexible and more work to run; its own licensing split |
| Grafana Loki | Cheaper on storage, label-based rather than full-text; no alerting on log content out of the box |
| Wazuh | Security-focused, built on OpenSearch, includes agent-based endpoint monitoring |
| LogExpert | A desk tool for reading one file at a time — the right choice when you do not need a server at all |
FAQ
Is Graylog Open free?
Yes, free to download and run. It is source-available under the SSPL rather than a classic open-source licence, which matters only if you plan to offer it as a service to others.
Can I install it on Windows?
No. The supported platforms are Linux distributions and containers.
Do I really need MongoDB and a separate search backend?
Yes. MongoDB holds configuration, the Data Node holds and searches the log data. Both are required.
How much disk will it use?
Plan roughly your daily log volume multiplied by your retention period, plus 20 %, plus three to five times the daily volume for the journal.
Can it replace a SIEM?
Graylog Open gives you collection, search, dashboards and alerts. Correlation rules, risk scoring and compliance reporting are in the paid Security edition.
Which version should I install?
The current 7.1.x line. Check the compatibility matrix for MongoDB and the search backend before upgrading anything.
