Sumo Logic vs Graylog: which fits your log platform?
If your Sumo Logic renewal, credit overrun or data residency rule is forcing a decision, Graylog is a self-hosted log platform you can run inside your own infrastructure, while Sumo Logic is a SaaS service that keeps operations and storage with its vendor. Graylog fits teams that need to control where logs live and how long they are kept, and that have people to run a search backend. Sumo Logic fits teams that want a managed service, accept its data location and billing model, and do not want to operate storage or upgrades themselves.
Graylog fits when logs must stay in your own data centers or cloud accounts, when retention is set by policy in index sets, and when your team can run Graylog server nodes, MongoDB and a Data Node or self-managed OpenSearch cluster. Graylog Open is free to self-manage with no ingestion caps, which shifts your cost toward hardware, storage and staff time. Sumo Logic fits when a single managed platform covers your log analytics and cloud SIEM needs and your organization prefers consumption billing and vendor-run operations over running a cluster.
Four decisions should settle the choice. First, confirm where logs must physically reside under your data residency rules. Second, calculate retention in days, using the sizing guidance in the Graylog architecture documentation, before comparing prices. Third, name the team that will patch, back up and scale the stack. Fourth, review the Server Side Public License on Graylog Open with your legal and procurement teams, because it is not an OSI-approved open source license, and the Enterprise and Security tiers are licensed on processed data. Confirm each term with Graylog directly before you commit.
Which platform fits which scenario?
This table maps common buying situations to the better fit between Sumo Logic and self-hosted Graylog. Read each row as a condition you can check in your own environment, then confirm it before you choose. Most rows point to Graylog only when you are ready to run its server nodes, MongoDB and a search backend yourself.
| Buyer situation | Better fit | Reason to verify |
|---|---|---|
| No internal team can be on call for the log platform | Sumo Logic | Sumo Logic runs the service as SaaS, so Sumo Logic staff operate the platform. With Graylog, your team owns server nodes, MongoDB, the search backend, upgrades and backups. |
| Logs must stay in your own cloud account or data center | Graylog | Graylog Open runs inside infrastructure you control. Confirm that your data residency rules allow the planned inputs, storage and any outbound notifications. |
| Long retention on storage you own | Graylog | Graylog index rotation and retention delete the oldest indices on your schedule. Estimate storage from daily ingest, retention days and a 120 percent headroom factor from the Graylog system architecture guidance, and confirm the figure in your own test. |
| Sumo Logic credit consumption is rising | Graylog | Graylog Open has no volume limits and no license fee, but you pay for compute, storage and staff time. Ask Sumo Logic for a usage forecast and compare it with a sized Graylog quote that includes the same retention. |
| Team already runs Elastic or OpenSearch | Graylog | Graylog Data Node or self-managed OpenSearch can reuse existing skills. Confirm the OpenSearch version, since Graylog 7.0 to 7.2 supports OpenSearch from 1.1.x up to 3.7.x and Graylog Security requires OpenSearch 2.0 or later. |
| Strict policy that accepts only OSI-approved open source | Sumo Logic | Graylog Open is licensed under the Server Side Public License, which is not OSI-approved. If your policy requires OSI approval, confirm the policy wording with legal before shortlisting Graylog. |
| Need for SIEM detections and threat content out of the box | Graylog | Graylog Security adds risk scoring, anomaly detection and prebuilt threat detection content under a paid license. Compare that feature set with the detection content your team would otherwise write and maintain. |
| Need for broad, managed log analytics across many teams | Sumo Logic | Sumo Logic provides managed search, dashboards and a hosted service across many sources. Graylog requires your team to design streams, pipelines and inputs for each source. |
How do the capabilities compare?
This table maps the main log analytics and SIEM capabilities of self-hosted Graylog against Sumo Logic's SaaS service. Read the Graylog column as documented behavior and the Sumo Logic column as a checklist to confirm in current Sumo Logic documentation before you decide. The main takeaway is that Graylog gives you direct control over storage and retention, while Sumo Logic hides that work, and the licensing and security content tiers need to be checked against your requirements.
| Capability | Graylog (self-hosted) | Sumo Logic (SaaS) |
|---|---|---|
| Log collection | Inputs such as syslog, GELF and Beats receive logs on Graylog server nodes | Collectors and cloud sources send data to the hosted service; confirm supported sources and collector types |
| Routing and processing | Streams route messages and processing pipelines transform them before storage | Ingest-time processing and field extraction exist; confirm how they are configured and billed |
| Search and query language | Graylog's own search syntax with dashboards built on search results; verify syntax against your existing searches | Sumo Logic's proprietary query language; confirm operator coverage and any features your team relies on |
| Dashboards | Dashboards built from search widgets; confirm sharing and access control for your user model | Hosted dashboards and panels; confirm sharing, scheduling and content library features |
| Alerting and notifications | Event definitions for real-time and historical monitoring, with notifications to PagerDuty, Slack and email per Graylog's product page | Monitors and alerts with connectors; confirm the notification targets you need |
| Storage and index management | Index rotation by message count, size or time; you choose the storage backend (Data Node or self-managed OpenSearch) | Storage is managed by the vendor; confirm where data is stored and how it is indexed or scanned |
| Retention control | Retention deletes the oldest indices, so you set the policy and see the storage it consumes | Retention is set per tier or plan; confirm the available periods and what changing them costs |
| Security analytics and SIEM content | Graylog Security adds threat detection, anomaly detection, risk scoring and investigations; requires OpenSearch 2.0 or later | Cloud SIEM content and threat detection are offered as a separate product; confirm the detection library and rule format |
| Compliance packs | Compliance packs are a Graylog Security feature; confirm which frameworks are covered and whether your assessor accepts them | Compliance content is available in Sumo Logic's security offering; confirm which frameworks and reports are included |
| Authentication options | Local users and external directory options are documented in Graylog's user authentication guide; confirm your identity provider | SAML-based single sign-on and role-based access are offered; confirm the exact options for your plan |
| Data export | Data stays in your own storage, so exports use your own tooling and backup processes | Browser CSV exports of search results are capped at 100,000 rows per export; use shorter time ranges for larger sets |
| Support | Community support with the Open edition; Enterprise and Security tiers add 24/7 support per Graylog's pricing page | Vendor support by plan level; confirm response terms and hours in your contract |
Streams, pipelines and search: where Graylog matches Sumo Logic daily work
Graylog routes every message through streams and processing pipelines before it reaches storage, which is the part of Sumo Logic daily work that most needs rebuilding. In Graylog Open, inputs such as syslog, GELF and Beats receive messages, streams sort them by rule, and pipeline rules parse, extract fields, drop noise and set the destination. Sumo Logic teams usually carry this logic in source configuration, field extraction rules, partitions and scheduled view logic. Before cutover, inventory every field extraction and partition your team relies on, then write each one as a pipeline rule and a stream rule in your own environment, with the original sample messages kept as test fixtures.
Search and dashboards are where the day-to-day feel changes most. Graylog provides a search interface, saved searches and dashboards built from widgets over the stored messages, and alerts come from event definitions that can notify through PagerDuty, Slack and email. The query language is not a drop-in copy of Sumo Logic's, so do not assume existing queries will run unchanged. Export a set of your heaviest and most frequently used searches, run them against a sample of real production data in a staging Graylog, and record which ones return the same results, which need rewriting, and which need a different approach. Confirm the current search syntax and dashboard features in the Graylog documentation for the version you plan to deploy.
Graylog's model suits a team when routing and normalization decisions can live in the company's own pipeline rules and when staff can read, test and maintain those rules over time. If your analysts depend on vendor-maintained parsers or content that arrives with the platform, plan to write or port that content yourself, or budget outside help for it. If your team has a clear owner for pipeline code, a review process for rule changes and a test set for each log source, Graylog gives you direct control over how messages are shaped. If no one on staff wants that ownership, the operating work moves to you, and that is a stronger reason to weigh a managed option than any feature gap.
What changes when logs stay in your own infrastructure?
Moving from Sumo Logic to self-hosted Graylog changes where log data sits, who operates the components and who holds the evidence. Each card below is a decision or check that follows from that shift, and most of them land on your own team or a contracted partner rather than a SaaS vendor.
Data location and residency
Sumo Logic is a SaaS service, so log data is stored in the regions Sumo Logic operates. With Graylog, log messages, indices and the message journal live wherever you deploy Graylog server nodes and Data Nodes, whether that is your cloud accounts, your data centers or an air-gapped network. Confirm which regions, subnets and backup targets hold log data, and whether any collector or forwarder crosses a boundary you have not approved.
Where the Graylog components run
A Graylog deployment is several parts: Graylog server nodes, MongoDB for configuration and metadata, and Graylog Data Node or self-managed OpenSearch for log storage. Each can sit in a different zone or site, and the multi-node pattern recommends separate clusters for each tier. Decide the placement of every tier, then document failure domains and who can reach the management interfaces.
Identity and authentication options
Sumo Logic access is governed by its own user and role model. In Graylog, you choose how users authenticate, which affects who can search streams, edit pipelines and change retention. Review the user authentication documentation, decide whether accounts are local or come from your directory, and confirm how administrator access, session timeouts and role mappings will be audited after go-live.
Audit evidence you must keep
When a vendor hosts the platform, some evidence comes with the service. Self-hosted, your team must produce and retain it: change records for pipelines and index sets, access reviews, backup and restore tests, retention settings history and alert configuration. Define where this evidence is stored, how long it is kept and who reviews it, before an assessor asks for it.
Compliance responsibility stays with you
Moving logs in-house does not transfer compliance obligations to a software project. Your organization remains responsible for the controls it relies on, including how logs are retained, protected and reviewed. DeployOpen prepares systems, configurations and evidence for assessments, but does not issue audit reports or attestations. Independent auditors and certification bodies decide conformance, so agree the assessor and the evidence list early.
Operating the platform yourself
Retention, index rotation, upgrades and patching of the Graylog and OpenSearch layers become recurring tasks for your staff or a retained partner. Graylog compatibility depends on specific MongoDB and OpenSearch versions, so each upgrade needs a checked matrix. Ask who owns on-call response, who tests restores and how the team will track version support windows.
What the SSPL license means for Graylog Open
Graylog Open is not licensed under an OSI-approved open source license. Since Graylog 4.0, released in 2020, the Graylog Open edition has been licensed under the *Server Side Public License* version 1 (SSPL-1.0). Earlier releases were licensed under GPL v3. The SSPL is not on the Open Source Initiative's list of approved licenses, so an organization whose policy requires OSI-approved software should not treat Graylog Open as meeting that requirement without a legal review. The license text is in the LICENSE file of the Graylog2/graylog2-server repository, and that file is the document your legal team should read, not this summary.
Free self-management under the SSPL is a different question from whether the license fits your policy. Graylog Open can be run without a license fee and without ingestion caps, but the SSPL governs how the software may be offered to others, which is the point where legal and procurement teams usually need to decide. Ask counsel to confirm whether your intended use, including any internal service you run for other business units or customers, is covered in the way you expect. Do not assume that a Sumo Logic-style comparison of features settles the license question, since the two products are licensed and delivered in entirely different ways.
Graylog Enterprise and Graylog Security are separate commercial licenses that sit on top of the free Open edition. Enterprise adds features such as the data lake, data tiering and support, and Security adds SIEM and threat detection content. Each is priced on processed data with a stated minimum, so a budget that covers only Graylog Open does not cover those capabilities. Confirm with Graylog which edition provides each feature your requirements list, and get the license terms for each in writing before you design the platform around them.
How do Graylog editions and Sumo Logic credits compare on price structure?
Graylog Open is the free, self-managed edition. Its license terms are the first thing to read, because it is distributed under the Server Side Public License rather than an OSI-approved license (see the Graylog Open product page). The product page and pricing page describe it as free with no volume limits and community support, so the cost moves from the license line to the infrastructure and people who run it.
- License fee: None for self-managed use, with no ingestion cap stated on the pricing page.
- Support: Community support only. Paid support requires an Enterprise or Security license.
- Recurring costs: Servers or cloud instances for Graylog nodes, MongoDB, and the OpenSearch or Data Node storage tier, plus storage for retention.
- Staff time: Patching, index management, backups, upgrades and on-call response fall to your team unless you contract them out.
- Features: Event definitions and notifications are included, but the data lake, data tiering, correlation engine and prebuilt SIEM content belong to the paid editions.
Confirm with Graylog which features your version includes and whether your intended use falls within the license terms before you rely on it in production.
Graylog Enterprise is the paid tier for teams that want vendor support and extended storage options on top of the open edition. The pricing page lists a starting price of 15,000 US dollars per year, with a minimum of 10 GB per day or 100 Graylog Compute Units, according to the Graylog pricing page. The license is based on processed data, with no per-user or per-device fees.
- Starting price: 15,000 US dollars per year, per the Graylog pricing page.
- Minimum commitment: 10 GB per day or 100 Graylog Compute Units.
- Licensing basis: Processed data, not users or devices, so adding analysts does not change the license line.
- Added capabilities: A data lake with archive restore, data tiering, a correlation engine and 24/7 support.
- Still your cost: Infrastructure for the nodes and storage, and the team that operates them, unless you buy a managed or services arrangement elsewhere.
Ask Graylog how daily volume, Compute Units and archive restore are measured on your data profile, and whether the minimum applies to your expected ingest.
Graylog Security is the security-focused paid edition. The pricing page lists a starting price of 18,000 US dollars per year, with the same minimum of 10 GB per day or 100 Graylog Compute Units and licensing on processed data, according to the Graylog pricing page. It is the higher starting price of the two paid editions, and the difference reflects the security feature set rather than a different volume basis.
- Starting price: 18,000 US dollars per year, per the Graylog pricing page.
- Minimum commitment: 10 GB per day or 100 Graylog Compute Units.
- Licensing basis: Processed data, with no per-user or per-device fees.
- Added capabilities: Risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content.
- Platform requirement: Graylog Security needs OpenSearch 2.0 or later, which affects the storage tier you build and maintain.
Confirm which compliance packs and detection content apply to your frameworks, and whether the OpenSearch version your environment requires is covered by your support scope.
Sumo Logic is a SaaS service sold on a credit-based model. Customers buy an allotment of credits, and usage of ingestion, storage, searches and related features draws them down according to the contract. No Sumo Logic price is stated in this comparison, because the price depends on the contract, the edition and the features chosen. Sumo Logic was acquired by Francisco Partners on May 12, 2023, so pricing and packaging should be confirmed directly with the vendor.
- Billing unit: Credits drawn down by consumption, not a flat per-edition list price.
- Cost drivers: Data volume, retention, search and dashboard activity, and the security features you add.
- Included in the bill: The hosted platform, its storage and its operation, which you do not run yourself.
- Exit considerations: Browser exports are limited to 100,000 rows per search, so historical data may need a separate export plan.
- Quote request: Ask for a written quote showing the credit model, overage terms, retention settings and what happens when usage exceeds the allotment.
Before comparing, request the Sumo Logic quote for the same ingest volume, retention period and features you would run on Graylog, then match the line items to the Graylog components above.
Where does the cost of a self-hosted Graylog stack come from?
A self-hosted Graylog stack has several cost lines, and only some of them are license fees. Compute, storage, the MongoDB and search backend, high availability, staff time and outside support each grow with different inputs, so a written quote should price each one separately.
Graylog license tier
Graylog Open carries no license fee, and the Server Side Public License imposes no ingestion caps on self-managed use. Enterprise and Security are paid tiers licensed on processed data, with no per-user or per-device fees, and the pricing page lists minimums of 10 GB per day or 100 Graylog Compute Units. Ask any quote to state the processed-data basis, the minimum that applies, and whether the data lake and correlation features are included or priced separately.
Server and storage compute
Log storage is the largest recurring line. The Graylog system architecture guidance is to size storage as daily ingest times retention days times 120 percent, so both ingest growth and longer retention raise disk need directly. Ask for the storage sizing in writing, including whether replicas are counted, and confirm which volumes are SSD for the message journal.
Journal and message buffer
The message journal absorbs bursts before indexing. Graylog advises 3 to 5 times daily ingest on SSDs, which adds fast-disk capacity that is easy to omit from first estimates. Journal size drives SSD cost on each Graylog node, so ask the implementer to show the journal calculation alongside the storage figure.
MongoDB and Data Node or OpenSearch clusters
Graylog needs MongoDB for configuration and metadata, and Data Node or self-managed OpenSearch for log storage. For medium to large deployments, the multi-node guide recommends three MongoDB nodes as a replica set and three Data Nodes on their own cluster. Each cluster is a separate set of VMs or instances with its own backup, so confirm the node count and version support in the compatibility matrix before pricing.
Load balancers and high availability
The recommended multi-node layout adds a load balancer in front of the Graylog nodes and marks follower nodes with is_leader set to false. These components are recurring infrastructure, and they also need monitoring and failover testing. Ask whether the quote includes the load balancer, its certificates and the cost of standby capacity during upgrades.
Staff time for operations and upgrades
Operating the cluster is the cost most often underestimated. Someone must patch the operating system, MongoDB and the search backend, manage index rotation and retention, and plan Graylog version upgrades, including the removal of OpenSearch 1.x support in Graylog 8.0. Ask the quote to state the operator hours per month and who covers on-call.
Outside support and retainers
Graylog Enterprise includes 24/7 support, while Graylog Open relies on community support. A managed retainer from an implementation partner is a separate, optional recurring charge for upgrades, monitoring and continuous testing. Compare it against the in-house hours you would otherwise need, and ask what response times and scope the retainer covers.
One-time migration effort
Moving from Sumo Logic means rebuilding collectors, streams, pipelines, dashboards and alerts, and deciding how much history to bring across. This is one-time work, but it recurs in parallel with dual running during cutover. Ask the quote to list each rebuilt component, the period of dual shipping, and how historical exports are handled.
What a move from Sumo Logic to Graylog involves
The sequence turns a Sumo Logic setup into a self-hosted Graylog platform that your team can size, operate and roll back during cutover, with a clear split between new data and history.
Inventory sources, collectors and searches
Your team lists every log source, Sumo Logic collector and installed source, the field extractions and parsers in use, and the saved searches, dashboards, scheduled searches and alerts that depend on them. Each source is tagged with its owner, daily volume, retention need and the compliance reason for keeping it. The output is a signed-off inventory that shows which items must move, which can be retired and which need a decision from the business owner. Ask Sumo Logic for the volume and retention settings your account actually uses, since your own billing data is the best starting point.
Size storage from daily ingest and retention
Using the daily ingest per source and the retention periods from the inventory, the team calculates total storage. Graylog's system architecture guidance advises sizing log storage as daily ingest multiplied by retention days, then multiplied by 120 percent, and giving the message journal 3 to 5 times daily ingest on SSDs. The sizing also decides how many Data Nodes and Graylog nodes are needed and which index rotation settings apply. The output is a written sizing sheet that the infrastructure owner approves, which becomes the basis for hardware or cloud instance requests.
Build the Graylog and MongoDB cluster
For medium to large deployments, Graylog's multi-node guide recommends three Graylog and MongoDB nodes with MongoDB running as a replica set, three Data Nodes on their own cluster, and a load balancer in front of the Graylog nodes. Follower Graylog nodes are set so that is_leader is false. Installation can use the Debian or RPM packages or Docker Compose, and Graylog recommends Data Node as the search backend. Confirm the MongoDB and Data Node versions against the compatibility matrix for the Graylog release you choose. The step closes when the cluster passes its health checks and a test message is searchable end to end.
Rebuild streams, pipelines and inputs
Your team recreates the collection inputs, such as syslog, GELF and Beats, then rebuilds routing in streams and processing pipelines to match the source inventory. Field extractions and parsing rules that lived in Sumo Logic are rewritten as pipeline rules and tested against sample messages from each source. Index sets are assigned so that rotation by message count, size or time and deletion of the oldest indices match the retention decisions from step two. The output is a test log per source that lands in the expected stream, index set and fields.
Rebuild dashboards, searches and event definitions
Saved searches and dashboards are recreated in Graylog's search and dashboard tools, and each Sumo Logic monitor or alert becomes a Graylog event definition with its notification route, such as email, Slack or PagerDuty, configured and tested. Query syntax differs, so each search is translated and checked against known results from the same time range in Sumo Logic. Owners sign off on each dashboard and alert. The step is complete when every item in the inventory has a documented Graylog equivalent or a recorded decision to drop it.
Run both systems in parallel during cutover
Collectors are configured to send the same logs to Sumo Logic and Graylog for an agreed overlap period, so that results can be compared source by source. The team checks event counts, field values, alert firing and dashboard figures, and records every gap before any source is switched off. Only after the owners accept the comparison is the Sumo Logic collector for that source removed. The output is a cutover record for each source showing the date it moved and who approved it.
Plan history separately from new data
New logs are the only data that flows into Graylog from the cutover date onward, so historical data needs its own plan. Sumo Logic's browser CSV export from the Download Search Results capability covers up to 100,000 rows per export, and larger exports need several searches over shorter time ranges, which is slow for big archives. Teams decide which history must be kept for compliance, export it in batches to storage they control, and confirm that it can be found and read when needed. The output is a history register listing each dataset, its time range, its format and where it is stored.
Operate, back up and retire the old platform
After cutover, the team sets up backups, monitoring of the cluster, user access, and a routine for upgrades. Graylog's guidance on user authentication should be applied to every administrator and analyst account. Sumo Logic is only switched off once the history register is complete and the retention obligations are met. The step closes with a runbook covering the cluster, its owners and the support route for each component, and a written confirmation from the business owners that the old service is no longer needed.
What do buyers ask before moving from Sumo Logic to Graylog?
What drives the total cost of moving from Sumo Logic to Graylog?
The main drivers are the Graylog edition, the volume you process, the infrastructure you run, and the people who operate it. Graylog Open has no license fee and no volume limits, while Graylog Enterprise and Graylog Security are licensed on processed data, with a published starting point of 15,000 US dollars per year for Enterprise and 18,000 US dollars per year for Security (Graylog pricing page), each with a minimum of 10 GB per day or 100 Graylog Compute Units. Infrastructure is recurring: the Graylog system architecture page advises sizing storage as daily ingest times retention days times 120 percent, plus a message journal of 3 to 5 times daily ingest on SSDs. Ask any quote to separate one-time setup from recurring license, hardware or cloud, staff time and support.
How long does a migration from Sumo Logic to Graylog take?
No duration figure is published in the sources for this migration, so treat any number you hear as a claim to verify. The time is set by how many collectors and sources you must repoint, how many searches, dashboards and alerts you must rebuild as streams, pipelines and event definitions, how much history you must carry over, and how many environments need a multi-node design. A medium to large deployment typically means three Graylog and MongoDB nodes, three Data Nodes and a load balancer, which adds build and test work. Ask for a fixed-scope plan that lists each source, each rebuilt item and the cutover steps before agreeing a timeline.
Can our internal team run the migration without outside help?
Yes, many teams do, but the work is substantial and needs people who already run log infrastructure. Your team would need to install Graylog from the Debian or RPM packages or with Docker Compose, plan the MongoDB replica set and the Data Node cluster, define inputs such as syslog, GELF and Beats, and rebuild your searches as streams and pipelines. If your current staff have no time for this alongside daily operations, ask a implementation partner for a fixed-scope engagement. DeployOpen plans, implements, integrates, hardens and documents self-hosted platforms in your own infrastructure, under a written scope agreed before work starts.
What skills and on-call time does running Graylog require?
Plan for Linux administration, MongoDB operations, search cluster operations, and ongoing upgrades. Graylog runs as server nodes with MongoDB for configuration and metadata and Graylog Data Node or self-managed OpenSearch for log storage, so an incident can sit in any of those layers. Index rotation and retention are configured by message count, size or time, and retention deletes the oldest indices, so someone must own those settings and watch disk capacity. Graylog Open is community supported, so for production paging ask whether you need Enterprise, with its 24/7 support, or a retainer for ongoing support and upgrades.
Does the Server Side Public License of Graylog Open fit our policy?
It depends on your open-source policy, and legal review is the right step. Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0) from Graylog 4.0 onward, replacing GPL v3 for earlier releases. The SSPL is not an OSI-approved open source license, so organizations that require OSI-approved licenses will not qualify it under that rule. Graylog Open can still be self-managed without ingestion caps, but ask your counsel whether the license terms fit internal use, managed service offerings or redistribution. If OSI approval is a hard requirement, compare Graylog with the Wazuh (GPLv2) or OpenSearch (Apache 2.0) options before deciding.
How do the Graylog compatibility matrix limits affect our OpenSearch and MongoDB choices?
Your version choices are constrained, so check them before you buy hardware. The compatibility matrix says Graylog 7.0 to 7.2 need MongoDB 7.x up to 8.2.x and support OpenSearch from 1.1.x up to 3.7.x, with Graylog Security requiring OpenSearch 2.0 or later. Use of OpenSearch 1.x is deprecated since Graylog 7.0 and will be removed in Graylog 8.0, and Graylog recommends Data Node as the search backend. Ask any quote to state which Graylog, MongoDB and search backend versions it targets, and how it plans upgrades when a later major release removes support.
What should we ask for in a Graylog migration quote?
Ask for a written scope with a named list of deliverables, so you can compare offers on the same basis. Request the sources and collectors to be repointed, the streams, pipelines, event definitions and dashboards to be rebuilt, the index and retention settings, the node layout for MongoDB and Data Node, backup and restore testing, and the handover documentation. Ask which items are one-time, which are recurring (support, upgrades, testing, retainers), and which costs sit outside the quote, such as Graylog licensing, compute and storage. Also ask how history is handled, since export paths for historical data differ from forwarding of new data.
How DeployOpen helps you evaluate, implement or migrate
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For Sumo Logic vs Graylog, we start with a written scope that tells you whether Graylog Open, Enterprise or Security fits your volume, retention and alerting needs, then build and hand over the environment.
How we scope
- Inventory current Sumo Logic sources, collectors, searches, dashboards and monitors before choosing a Graylog edition
- Size daily ingest, retention and index storage against your own volumes, with the sizing method stated in writing
- Agree in writing whether Graylog Open, Enterprise or Security is in scope, and what licensing terms apply
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts
How we build
- Deploy Graylog server nodes, MongoDB and Graylog Data Node or self-managed OpenSearch in your cloud accounts or data centers
- Configure inputs, streams and processing pipelines, then rebuild dashboards and event definitions for alerting
- Set index rotation and retention to match your policy, and test that old indices are deleted as expected
- Test alert routing to your paging, chat and email channels, and review access controls for each team
How we hand over
- Document the architecture, configuration, index model, retention settings and rebuilt searches and alerts
- Provide runbooks for upgrades, backups and recovery of MongoDB and the search backend
- Prepare control evidence and records for your compliance assessment, which independent auditors then evaluate
- Walk your operations and security teams through the handover before the written scope closes
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover
- Security testing of the Graylog deployment and its APIs can be scoped separately in writing
- Confirm supported version pairings with your Graylog and MongoDB or OpenSearch versions before each upgrade
- Ask for a quote based on your written scope, since DeployOpen does not publish a price list
