Graylog
Mature log management and search with streams, pipelines, dashboards, and alerting. A practical Splunk alternative for log-heavy teams.
| License | SSPL-1.0 |
| Repository | https://github.com/Graylog2/graylog2-server |
| GitHub stars (approx) | 8100 |
| Language | Java / TypeScript |
| Self-host deployment | docker-compose, deb/rpm packages, tarball |
| Commercial hosted option | yes (vendor-run) |
| Freshness status | Fresh |
| Freshness checked | 2026-06-23 |
| Categories | logs |
| Replaces SaaS | splunk, datadog |
Graylog is a long-running log management platform built around ingestion, parsing, search, streams, dashboards, and alerts. It is closer to Splunk’s operational log workflow than to an OpenTelemetry-first APM suite.
Pick it if: you need a familiar log-search console with parsing pipelines, role-based access, alerting, and enough security analytics to cover SIEM-lite use cases.
Skip it if: you want a unified traces + metrics + logs platform, or you want the cheapest possible object-storage log lake. Graylog is a stack and depends on MongoDB plus Graylog Data Node or self-managed OpenSearch for indexed search.
Deployment: Docker Compose for single-node starts, DEB/RPM packages for Linux servers, and tarballs for custom installs. Plan the backing MongoDB and search/data-node layer deliberately before treating it as production infrastructure.