Comparisons anchored on Graylog, the log management platform whose free Graylog Open edition is SSPL licensed and therefore not OSI open source.
Whether to run Graylog on top of OpenSearch or OpenSearch with Security Analytics on its own: SSPL versus Apache-2.0, what Graylog adds (streams, pipelines, alerting) and what sits in paid Graylog editions, and when the extra layer pays for itself.
Security Onion's network security monitoring distribution against Graylog's log platform: two non-OSI licenses (ELv2 and SSPL), packet capture and IDS against log pipelines, hardware sizing and paid Pro and Enterprise features.
Graylog against a self-built Elastic Stack (Elasticsearch, Logstash, Kibana) for log management: built-in inputs, streams and alerts against Kibana flexibility, SSPL against ELv2 or AGPL, and paid features on each side.
Graylog's indexed search and alerting against Loki's low-cost label-based log storage: MongoDB plus OpenSearch against object storage, SSPL against AGPLv3, authentication and which suits security teams versus platform teams.
Whether a Graylog deployment should store logs through Graylog Data Node, which installs and manages OpenSearch for you, or through an OpenSearch cluster your team runs. Covers what Data Node takes over (certificates, cluster membership, versions), supported self-managed OpenSearch versions, hardening left to you, Enterprise-only Data Node views and the in-place migration path.
When one Graylog server is enough and when to move to Graylog's multi-node Conventional architecture of three Graylog and MongoDB nodes plus a separate Data Node cluster. Covers the MongoDB replica set, leader and follower settings, load balancer, heap and journal sizing, and the operating effort each layout adds.
Which Graylog edition a self-managed log or SIEM deployment needs: what free Graylog Open covers, when Enterprise's data tiering, correlation engine, SSO and audit logs are required, and when Security's anomaly detection and MITRE ATT&CK mapped rules justify the higher yearly price.
Whether to buy Graylog as the vendor-run Graylog Cloud or license it for your own servers: default live and archive retention, the LDAP, OIDC, output, plugin and server access features Cloud does not offer, and the infrastructure and uptime work self-managed customers take on.
The SIEM layer on each stack rather than plain log management: Graylog Security, priced from 18,000 US dollars a year on top of SSPL Graylog Open, against Elastic Security, which splits its detection, machine learning and endpoint protection features between Elastic's free Basic tier and paid subscriptions. Covers licensing, storage backends, detection content and which suits a team already running Graylog or Elasticsearch.
Three ways to run self-hosted log management compared: Graylog (SSPL, Graylog Enterprise paid), the Elastic Stack (ELv2, SSPL or AGPLv3) and Grafana Loki (AGPLv3), on indexing model, licensing and what each needs to operate.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.