LogRhythm vs Graylog: when each option fits the LogRhythm alternative decision
Choose LogRhythm when your team wants a packaged SIEM with vendor-supported detection content and one party to call when something breaks. Choose Graylog Open when your team can run log infrastructure itself and will write or tune its own detections. A renewal, a licensing change or a data residency requirement usually forces this question, so start by listing which operating model your security and platform staff can sustain for the next several years. Graylog Open is free to self-manage under the Server Side Public License with no ingestion caps, but its support is community-based. Its alerting relies on event definitions for real-time and historical monitoring, with notifications that can go to PagerDuty, Slack and email. You design and maintain those definitions.
Graylog's paid tiers change the comparison for SIEM work. Graylog Enterprise adds a data lake, a correlation engine and 24/7 support, and its published pricing starts at 15,000 US dollars per year. Graylog Security adds risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content, starting at 18,000 US dollars per year. Both tiers carry a minimum of 10 GB per day or 100 Graylog Compute Units, are licensed on processed data, and have no per-user or per-device fees. Check those minimums against your daily volume, and ask whether the Security content covers the rules your analysts and auditors rely on today. The current terms are on the Graylog pricing page).
The decision turns on three questions. First, how much of your detection content must arrive prepackaged, and how much you can build from event definitions and dashboards. Second, whether your team can operate Graylog server nodes, MongoDB for configuration and metadata, and Graylog Data Node or self-managed OpenSearch for storage, including index rotation and retention sizing. Third, whether a paid tier is required at all, or whether Graylog Open plus your own rules meets your obligations. Before deciding, ask legal counsel to review the Server Side Public License, which is not an OSI-approved open source license, and confirm that the chosen tier includes the support model your incident response plan requires.
Which platform fits which scenario
This table matches common buyer conditions to the platform that usually fits them better, with the reason tied to licensing, features or support. Read each row against your own constraints, since the better fit depends on what your team must operate and what your auditors and budget require.
| Buyer condition | Better fit | Why |
|---|---|---|
| Existing LogRhythm estate with a SOC running packaged rules | Neither alone, confirm rule translation first | Graylog uses its own stream, pipeline and event definition model, so packaged LogRhythm rules must be rebuilt rather than imported. Plan that effort before comparing licenses. |
| Strong Linux and search skills, wants full control | Graylog Open | Graylog Open is free to self-manage under the Server Side Public License with no ingestion caps, and the team can run the server nodes, MongoDB and Data Node or OpenSearch itself. |
| Regulated buyer that needs contracted vendor support | Graylog Enterprise or Graylog Security | Graylog Enterprise includes 24/7 support, and Graylog Security adds SIEM features. Confirm the support terms and SLA in the written contract, since they are not set out in this comparison. |
| Budget-constrained team with no license line | Graylog Open | The software has no license fee and no volume limits. Staff time, servers, storage and any outside help become the main costs to plan for. |
| Team needs SIEM features such as risk scoring and anomaly detection | Graylog Security | Risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content are listed as Graylog Security features. Open does not include them, so confirm each feature in the current product documentation. |
| Need for a correlation engine and data tiering without SIEM add-ons | Graylog Enterprise | Graylog Enterprise adds a data lake with archive restore, data tiering and a correlation engine. Compare this with the event definitions available in Graylog Open before deciding. |
| Strict license terms for the software stack | Confirm with legal before choosing Graylog Open | Graylog Open is licensed under the Server Side Public License, which is not an OSI-approved open source license. Legal and procurement teams should review it against internal open source policy. |
How Graylog routes logs through streams and pipelines
The Graylog data path runs in a fixed order: inputs receive messages, streams classify them, processing pipelines transform them, and indices store the results. Inputs such as syslog, GELF and Beats are where a SOC first touches a source, so the input configuration is the first thing to inventory when moving off LogRhythm. Streams decide which index set a message lands in and which alerts and dashboards see it. Because routing happens before storage, a stream and index set design determines how long each class of log is kept and who can search it. Confirm this model against the Graylog index model documentation for the version you deploy, since the stream and index set terms are documented there.
Retention in Graylog is set per index set through rotation and retention. Indices rotate by message count, size or time, and retention deletes the oldest indices once the configured limit is reached. This means retention is enforced in chunks rather than per event, so a rotation period that is too coarse can keep more data than the policy intends, and one that is too fine creates many small indices to manage. For a regulated SOC, map each LogRhythm retention requirement to a separate index set with its own rotation and retention settings before any source is cut over. Ask your compliance lead to confirm the required retention periods in writing, because the oldest-index deletion behavior will remove data without a separate archive step.
A SOC migrating from LogRhythm should expect that sources and inputs can be re-pointed, but rules and routing logic will not transfer directly. Stream rules, pipeline rules and event definitions are built in Graylog and must be recreated and tested against replayed or parallel-run data. LogRhythm AI Engine rules, its parsing and its report templates have no one-to-one export into Graylog objects, so each detection needs a rebuilt equivalent and a documented owner. Keep the original LogRhythm rule list, mapped to its Graylog replacement, as the evidence trail for auditors. Plan a parallel run long enough to compare alert volumes for each rebuilt rule before LogRhythm is switched off.
Where the data lives and who controls it
Graylog Open and a self-managed backend keep log data, configuration and access decisions inside your own servers or cloud accounts. The cards below cover the components that hold that data, the residency and access questions to settle first, and the evidence an assessor will ask to see.
Self-managed Graylog Open
Graylog Open runs on servers or cloud accounts you control, so the Graylog server nodes, inputs and processing pipelines see your logs only where you deploy them. LogRhythm customers usually compare this with a vendor-hosted or appliance model, so map each log source to a specific Graylog node and confirm which network segments can reach its syslog, GELF and Beats inputs. Note that the server-side license is a licensing question, not a data-location one, and it should be reviewed by counsel for your use case.
Data Node or OpenSearch storage
Log messages are stored in the search backend, which is Graylog Data Node or self-managed OpenSearch. Retention is a storage decision: indices rotate by message count, size or time, and the oldest indices are deleted when retention applies. Before go-live, document which index sets hold regulated data, where replicas sit, and who can snapshot or delete indices at the storage layer, since that access sits outside Graylog's own roles.
MongoDB holds configuration
MongoDB stores Graylog configuration and metadata, such as users, streams, pipelines and event definitions, while log messages live in the search backend. This split means a MongoDB backup or restore affects the rules and access model, not the log archive. Confirm which team owns the MongoDB replica set, how its backups are encrypted and where they are stored, and whether restore tests have been run against a copy of the production configuration.
Residency and access control
Residency depends on where each Graylog node, Data Node and MongoDB member runs, plus any backup copies and alert integrations such as email, Slack or PagerDuty that carry message content out of your environment. Map each destination against your data residency rules and decide which roles may search, export or change streams. Ask your integrator to document the exact network paths before log data leaves the cluster.
User authentication options
Graylog's user authentication documentation describes how local accounts and external directories are configured, and the choice affects how joiners, movers and leavers are handled for the SIEM. Decide whether analysts authenticate against your existing identity provider, how privileged administrators are separated from analysts, and how sessions and API tokens are reviewed. Confirm these options against the version you deploy, because settings change between releases.
Evidence retention for assessments
Auditors often ask for log retention settings, change history for detection rules and records of who searched or exported sensitive data. In Graylog, these records depend on your retention configuration, your audit logging setup and how exported archives are stored. DeployOpen prepares controls, configurations and evidence for compliance assessments, but it does not issue audit reports or certifications; independent auditors and certification bodies do that work. Ask your assessor early which artifacts they will sample.
Graylog Open, Enterprise and Security: what the license and price change
Start with the license, because it affects legal review before any price comparison. Starting with Graylog 4.0 in 2020, Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0), which replaced the GPL v3 used for earlier releases. The SSPL is not an OSI-approved open source license. Many organizations accept source-available terms without difficulty, but your legal and procurement teams should review the SSPL against your own use, especially if you plan to offer Graylog-based services to third parties or to modify and redistribute the server. The license text is in the Graylog2/graylog2-server LICENSE file, and that is the document to hand to counsel.
On price, the published model has three tiers. According to the Graylog pricing page, Graylog Open is free with no volume limits and community support. Graylog Enterprise starts at 15,000 US dollars per year and Graylog Security starts at 18,000 US dollars per year. Both paid tiers carry a minimum of 10 GB per day or 100 Graylog Compute Units, are licensed on processed data, and carry no per-user or per-device fees. Your recurring cost therefore follows the volume you process, not the number of analysts. Confirm the current figures, minimums and what counts as processed data on the pricing page, since these terms change, and ask the vendor in writing how a seasonal or burst ingest pattern is billed.
Compare these figures with your LogRhythm quote line by line, not as a single total. Ask LogRhythm or Exabeam for the subscription, support, storage and any appliance or add-on charges, and map each to the Graylog tier that covers the same capability. Graylog Enterprise adds the data lake, the correlation engine and 24/7 support, while Graylog Security adds the SIEM features such as risk scoring and prebuilt threat detection content, so a fair comparison includes the features you actually use. Remember that Graylog's paid licenses do not cover the servers, MongoDB, OpenSearch or Data Node storage, or the staff who run them, so add those to the Graylog side before you compare totals.
What a Graylog deployment costs compared with a LogRhythm subscription
A LogRhythm subscription bundles software, support and often appliances into one commercial relationship, while a Graylog deployment splits cost across licensing, servers, storage and staff. The cards below separate one-time from recurring items so you can build a like-for-like comparison from your own quotes and sizing.
LogRhythm license and support
Ask LogRhythm for the subscription or perpetual license terms, what support tier is included, and whether appliances, collectors and storage are priced separately. Confirm the renewal uplift and what happens to detection content and updates if you stop renewing. These are recurring costs in a subscription model, and volume or device count typically drives them up. Request the quote in writing so you can line it up against the Graylog items.
Graylog Open license
Graylog Open carries no license fee. It is free to self-manage under the Server Side Public License, with no ingestion caps. Your costs move to infrastructure, staff and any outside support you buy. Remember that the license is SSPL-1.0, not an OSI-approved license, so have legal confirm it fits your internal use and any distribution you plan.
Graylog Enterprise or Security subscription
If you need the data lake, correlation engine, 24/7 support or SIEM features such as risk scoring and prebuilt threat detection content, you pay an annual subscription on top of the infrastructure. Graylog's published pricing lists Enterprise from 15,000 US dollars per year and Graylog Security from 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units. This is a recurring cost driven by the tier and processed volume, so confirm current terms on the pricing page.
Servers for Graylog, MongoDB and Data Nodes
Graylog runs as server nodes with MongoDB for configuration and metadata, and Graylog Data Node or self-managed OpenSearch for log storage. For medium to large deployments, the multi-node guide recommends three Graylog and MongoDB nodes, three Data Nodes on their own cluster and a load balancer. These are one-time hardware or cloud purchases followed by recurring hosting, and node count grows with ingest rate and search load. Check the compatibility matrix before choosing MongoDB and search versions.
Storage sized by ingest and retention
The architecture guidance sizes log storage as daily ingest multiplied by retention days, then multiplied by 120 percent. This is the cost that grows fastest with retention, and it recurs as disk, replacement and backup. Shortening retention or routing low-value logs away from the index are the main levers. Ask LogRhythm how it prices storage tiers and archive restore so the retention scenarios are comparable.
Message journal on SSDs
The message journal buffers incoming logs before they are indexed, and the system architecture guidance advises sizing it at 3 to 5 times daily ingest on SSDs. This is a one-time hardware cost per node, and fast disks raise it. Undersizing the journal is a common reason to lose data during an indexing backlog, so include it in the hardware line rather than treating it as spare capacity.
Staff time and detection engineering
Staff time is the largest recurring cost in most self-hosted deployments, covering platform operations, upgrades, index management and detection rule tuning. Commercial SIEMs also need this work, but the split differs. Estimate hours from your own team's capacity and confirm whether a vendor or outside partner will carry any of it. Migration of LogRhythm rules, parsers and compliance reports is a one-time effort that should be scoped separately from run costs.
What moving from LogRhythm to Graylog involves
The sequence turns LogRhythm's collection, detection and reporting into a Graylog deployment that can be validated side by side, then retired without losing the history auditors need. Each step produces a checkable artifact before the next one starts.
Inventory sources, AI Engine rules and reports
Your team lists every log source feeding LogRhythm, including System Monitor agents, syslog senders and API integrations, and exports the AI Engine rules, alarms, saved searches and compliance reports in use. DeployOpen can run this inventory with your SIEM administrators and map each item to a Graylog input, event definition or dashboard. It is done when every source has an owner, a volume estimate and a target, and every rule is marked as rebuild, retire or replace with a Graylog pipeline rule.
Size the cluster from daily ingest and retention
Measure average and peak daily ingest per source, then apply the Graylog system architecture guidance: daily ingest multiplied by retention days multiplied by 120 percent for log storage, plus a message journal of 3 to 5 times daily ingest on SSDs. Confirm the Graylog version you will deploy against the compatibility matrix, since Graylog 7.0 to 7.2 pair with specific MongoDB and OpenSearch ranges, and Graylog Security needs OpenSearch 2.0 or later. It is done when a written sizing sheet is approved by the security and infrastructure owners.
Stand up the multi-node Graylog cluster
Build the production topology the Graylog multi-node guide describes for medium to large deployments: three Graylog and MongoDB nodes with MongoDB as a replica set, three Data Nodes on their own cluster, and a load balancer in front of the Graylog nodes. Set is_leader to false on follower Graylog nodes, and install from the Debian or RPM packages or Docker Compose as your standards require. Harden authentication and role mapping at this stage. It is done when a failover test passes and the cluster health is confirmed on every node.
Rebuild collection with inputs, streams and pipelines
Recreate each collection path as a Graylog input (syslog, GELF or Beats, depending on the sender), then route messages with streams and processing pipelines so that parsing, field normalization and enrichment match what LogRhythm did. Assign index sets with rotation and retention that match your sizing sheet, because retention deletes the oldest indices. It is done when each source produces the same fields in Graylog as it did in LogRhythm, checked against a sample of recent events.
Recreate event definitions and notifications
Translate each AI Engine rule and alarm into a Graylog event definition, choosing real-time or historical evaluation for each one, and connect notifications to your paging, chat or email channels. Graylog Open's product page lists PagerDuty, Slack and email as notification targets, and correlation depth beyond that depends on the edition you license, so confirm the detection features you need with Graylog before you commit. Rules that depend on LogRhythm-specific constructs need manual redesign. It is done when each rule has a documented test event that fires its notification.
Run both platforms in parallel
Feed the same sources to LogRhythm and Graylog for an agreed overlap period set by your risk owners, and compare alert volumes, false positive rates and search results for the same incidents. Discrepancies go back to the rule or pipeline owner for correction. DeployOpen can document the comparison and the sign-off criteria. It is done when the security owner signs off that Graylog detects the scenarios in your register at an acceptable level.
Rebuild compliance reports and export LogRhythm history
Rebuild each compliance report as Graylog dashboards, saved searches and scheduled outputs mapped to the controls your auditors reference, and confirm with your assessor which evidence they will accept. Export LogRhythm history in a format your retention policy and auditors accept, store it in write-protected archive storage with an index of what it contains, and confirm how long it must be kept. Independent auditors and certification bodies decide what is sufficient; DeployOpen prepares the evidence. It is done when the assessor has reviewed a sample report and the archive can be searched.
Decommission LogRhythm appliances
After sign-off and the archive check, disable LogRhythm collection, revoke agent and API credentials, and retire the appliances according to your data retention and media disposal policies. Keep the exported archive available for the period your obligations require. Review the Graylog backup and upgrade plan before the old platform is removed. It is done when collection has stopped, credentials are revoked and the decommissioning record is filed with your compliance owner.
Questions buyers ask before choosing Graylog over LogRhythm
Can Graylog Open fully replace LogRhythm on its own?
Graylog Open can cover log collection, search, dashboards, streams, processing pipelines and event-based alerts, but it is not a complete drop-in for every LogRhythm capability. Graylog Open is free to self-manage under the Server Side Public License with no ingestion caps, and it supports inputs such as syslog, GELF and Beats. Before deciding, map your current LogRhythm use cases one by one: AI Engine correlation, case management, compliance report packs and any vendor-specific agents. Items that depend on the Enterprise or Security editions, such as the correlation engine, risk scoring, anomaly detection and prebuilt threat content, need a separate decision. Confirm each gap with Graylog's current documentation before you commit.
What drives the cost of migrating from LogRhythm to Graylog?
Migration cost is mostly labor and infrastructure, and it is largely one-time. The main drivers are the number of log sources and agents to repoint, the number of correlation rules and reports to rebuild as event definitions and pipeline rules, the volume of history you must keep searchable, and the number of teams that depend on current dashboards. Recurring costs are the servers, storage and MongoDB and OpenSearch or Data Node operations that you run yourself. Ask any provider for a written scope that lists sources, rules, reports, retention and environments, because those items determine the quote. Graylog's own pricing is per processed data, so it is worth confirming licensing terms for your daily volume.
How long does a Graylog migration take?
The timeline depends mainly on source count and rule volume, so no single duration applies. A small estate with a handful of sources and few custom rules can move faster than one with hundreds of agents, many correlation rules and regulated reports that auditors will review. Plan in phases: build the cluster, run Graylog in parallel with LogRhythm, move sources in groups, rebuild alerts and reports, then keep historical data available until your retention obligations are met. Your own sizing, not a generic estimate, should set the schedule. Ask any provider to tie the timeline to a written scope with defined deliverables.
Can our own team migrate to Graylog without outside help?
A capable team can migrate without outside help if it has time, Linux and database operations experience, and someone who owns detection content. The risk lies less in installing Graylog than in re-creating detection logic, validating that no sources were dropped, and proving retention for auditors. Graylog's installation documentation covers Debian and RPM packages and Docker Compose, and a multi-node setup involves load balancing and a replicated MongoDB. Teams that lack this experience, or that must meet a fixed compliance date, often bring in outside help for a fixed-scope piece such as architecture, hardening or testing. DeployOpen plans and implements self-hosted platforms in the client's own environment and agrees scope in writing before work starts.
What skills does a self-hosted Graylog deployment need?
Running Graylog requires three areas of skill: Linux administration, MongoDB and a search backend. Graylog server nodes use MongoDB for configuration and metadata, and log storage runs on Graylog Data Node or self-managed OpenSearch. The compatibility matrix lists the supported version ranges, so staff must track them during upgrades. Engineers also need to understand index rotation and retention, which delete the oldest indices, and the multi-node guide, which recommends three Graylog and MongoDB nodes, three Data Nodes, and a load balancer for medium to large deployments. Staff should also be comfortable with pipeline rules and event definitions, which replace many LogRhythm rules.
Does Graylog Security cover typical SIEM needs?
Graylog Security adds SIEM features that go beyond Graylog Open, including risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content, according to Graylog's product materials. Whether it covers your needs depends on your detection catalog, your data volume and the reports your auditors expect. Graylog Security requires OpenSearch 2.0 or later, so the platform choice affects your upgrade path. Compare its feature list against your LogRhythm use cases item by item, and ask Graylog to confirm which content ships in your edition. Pricing starts at 18,000 US dollars per year, with a minimum of 10 GB per day or 100 Graylog Compute Units, according to Graylog's pricing page.
What is the difference between Graylog Open and Enterprise support?
Graylog Open is free with community support, while Graylog Enterprise adds a data lake with archive restore, data tiering, a correlation engine and 24/7 support. Enterprise starts at 15,000 US dollars per year with a minimum of 10 GB per day or 100 Graylog Compute Units, according to Graylog's pricing page. Community support means you rely on public channels and your own staff for troubleshooting, upgrades and incident response. Enterprise support moves that risk into a contract, but it does not remove the need for internal ownership of pipelines, rules and retention. Weigh the support terms against your uptime and audit obligations, and ask Graylog for the exact service levels in writing.
How does the OpenSearch 1.x deprecation affect Graylog planning?
Graylog deprecated use of OpenSearch 1.x starting with Graylog 7.0, and it will be removed in Graylog 8.0, so any new build or upgrade should target a supported backend now. Graylog recommends Data Node as the search backend. If your current estate runs OpenSearch 1.x, plan the backend upgrade as its own project before you change Graylog versions, and test index compatibility with a copy of your data. Graylog Security requires OpenSearch 2.0 or later. Confirm current support in the compatibility matrix and the installation documentation before you set your sequence.
Questions to answer before you commit to a switch
The switch from LogRhythm to Graylog turns on five questions, and the answers should be written down before anyone signs a Graylog Enterprise or Graylog Security order. The first is detection content on day one. LogRhythm customers often rely on AI Engine rules, prebuilt alarms and compliance reports that were tuned over years. Graylog Open gives you event definitions, streams and pipelines, but the prebuilt threat detection content and risk scoring sit in Graylog Security. List the detections your SOC uses every week and check which of them you can rebuild in Graylog Open and which depend on the paid tier.
The second question is whether you need vendor 24/7 support. Graylog Open comes with community support, while Graylog Enterprise adds 24/7 support and the correlation engine. The third is how much LogRhythm history must stay searchable. Auditors often ask for a defined retention window, and Graylog retention deletes the oldest indices once the rotation limits are reached, so decide how old the data must be and whether it needs to be exported or restored from an archive. The fourth is data residency. Graylog runs on your servers with MongoDB and Data Node or self-managed OpenSearch, so confirm where each tier of storage lives, who holds the backups and whether any licensed component sends telemetry out of your boundary.
The last question is in-house operating capacity. A multi-node Graylog deployment needs MongoDB, a search backend, a load balancer and sizing work for storage and the message journal, and someone must own upgrades across versions that the compatibility matrix limits. Before committing to a paid tier, run a proof of concept on a subset of sources, such as firewalls and identity logs, and measure detection coverage, search speed and the effort to maintain it. Use the results to request a written quote from the scope you tested, not from the full estate you hope to move.
How DeployOpen helps you evaluate, implement or migrate to Graylog
DeployOpen is a Chainscore Labs company that plans, implements, integrates, hardens, backs up, documents and supports self-hosted open-source platforms in your own cloud accounts, data centers or air-gapped networks. For LogRhythm vs Graylog, we start from your current log sources, retention and detection needs, then build the Graylog deployment and its evidence inside your environment.
How we scope
- We inventory LogRhythm log sources, parsing rules, alert logic and report outputs before choosing a Graylog design.
- The written scope names which inputs, streams, pipelines, event definitions and dashboards are in and out.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work starts.
How we build
- We size the Graylog server nodes, MongoDB, and Data Node or self-managed OpenSearch storage against your ingest and retention.
- We rebuild collection, streams, processing pipelines and event definitions, then test them against replayed or sample traffic.
- Security testing of the deployed platform can be scoped alongside the build, covering access paths and configuration.
How we hand over
- You receive architecture, installation, configuration and runbook documentation covering each deployed component.
- We document index rotation and retention settings so you can show how long each log class is kept.
- Compliance readiness material, such as control mapping and evidence, is prepared for your independent auditors, who issue any reports.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Upgrade planning follows Graylog's compatibility matrix, including the move away from OpenSearch 1.x.
- Confirm with us in writing which support hours, response commitments and backup tasks are included before signing.
