Graylog Open vs Enterprise: when the free edition is enough
A team that runs its own log collection and asks which Graylog edition it needs should start with a narrow question: does the work stop at ingestion, search, dashboards and basic alerting? If it does, Graylog Open is free with no volume limits, and the pricing page lists it with log collection, pipelines, search, dashboards, basic triggers, local role-based access control, Data Node and multi-cluster support, and REST API and MCP server access. Community support is the only support tier. Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0) since Graylog 4.0, which is not an OSI-approved open source license. Legal and procurement teams should have counsel read the SSPL terms against their own hosting and redistribution plans before they standardize on it, because the license governs what the team can offer others, not just what it pays.
The move to a paid edition is driven by specific features, not by log volume. Graylog Open does not include data tiering, the correlation engine, SSO or user audit logs. A team that needs hot, warm and archive tiers, correlation across event streams, SSO through its identity provider, or an audit trail of user actions should price Graylog Enterprise, from 15,000 US dollars per year, which adds those controls along with scheduled reports and LDAP-backed roles. A team that also needs identity-based risk triage, automatic case creation, machine learning anomaly detection, MITRE ATT&CK mapped detection rules or Sigma rule support should price Graylog Security, from 18,000 US dollars per year. Both figures are published starting prices with a minimum of 10 GB per day or 100 Graylog Compute Units, so the quote will scale with processed volume in the active data tier.
Before deciding, the team should map each requirement to an edition and confirm it in writing. Ask the vendor which features are included in the quoted tier, how archive restore is licensed, and whether the figures apply to the team's processed volume. Also budget for the self-managed costs that no edition removes: MongoDB, the search backend, servers and staff time. Graylog Open can be a sound choice for a team with a single operator who needs search and alerting, but an audit or SSO requirement from a regulator or internal policy usually changes the answer. An independent review of the written requirements against the Graylog pricing page is the natural next step.
Which capabilities sit in each Graylog edition
This table maps the capabilities named on the Graylog pricing page to each edition, with confirmation notes where the published facts are silent. Read each row as a question to settle before purchase: if a control you need appears only in a paid column, price that edition. The main takeaway is that Graylog Open covers collection, search and basic alerting, while tiering, correlation, SSO, audit logs and the detection content sit in the paid editions.
| Capability | Graylog Open | Graylog Enterprise | Graylog Security |
|---|---|---|---|
| Log inputs, pipelines, search and dashboards | Syslog, GELF and Beats inputs with pipelines, search and dashboards | Included, confirm any edition-specific input or parser limits with Graylog | Confirm with Graylog whether all Enterprise features are included |
| Basic triggers and notifications | Basic triggers with PagerDuty, Slack and email notifications | Advanced notifications and advanced search | Confirm with Graylog |
| Local role-based access control | Yes, local RBAC | Local RBAC plus teams and LDAP role-based access | Confirm with Graylog |
| Single sign-on, LDAP and teams | Not listed on the pricing page for Open | SSO, LDAP role mapping and teams | Confirm with Graylog whether SSO and LDAP carry over |
| Data tiering and data lake | Not included | Data lake routing, hot, warm and archive tiering, archive restore | Confirm tiering and data lake terms with Graylog |
| Correlation engine | Not included | Included | Confirm with Graylog |
| User audit logs | Not included | Included | Confirm with Graylog |
| Anomaly detection and automatic case creation | Not included | Confirm with Graylog | Machine learning anomaly detection and automatic case creation |
| MITRE ATT&CK mapped rules, Sigma support and watchlists | Not included, prebuilt detection content is paid | Graylog-maintained alert rules, confirm MITRE mapping with Graylog | MITRE-mapped detection rules, Sigma support and watchlists |
How license, support and updates differ by edition
The three Graylog editions differ less in the software itself than in the license under which you receive it, the support you can buy, and the terms you sign. Each card below covers one of those decisions so you can check it against your own policy and budget before you shortlist a tier.
SSPL-1.0 license on Graylog Open
Graylog Open has been licensed under the Server Side Public License version 1 since Graylog 4.0 in 2020, replacing GPL v3 for earlier releases. SSPL-1.0 is not approved by the OSI, so an organization whose policy requires OSI-approved open source must treat Graylog Open as source-available rather than open source. Ask your legal and procurement team to review the license text against how you plan to host and offer the service internally.
Community support on Open
Graylog Open comes with community support and no volume limits, so the operational burden of incidents, upgrades and tuning falls on your own team or a partner you contract separately. Confirm whether your internal runbooks, on-call rota and patching windows can absorb that before you rely on Open for detections that feed incident response.
24/7 support in Enterprise
Graylog Enterprise adds 24/7 support to the data lake, tiering and correlation features. Ask Graylog for the written support hours, severity definitions and response commitments that apply to your contract, since the pricing page does not give those terms. Compare them against the incident response windows your security operations team has committed to internally.
One to five year subscriptions
Enterprise and Security are sold as annual subscriptions for one to five years, with a minimum of 10 GB per day or 100 Graylog Compute Units. The term length sets how long you commit to a price and volume tier, so model the expected growth in processed data over the contract before choosing between a short term and a longer one. Confirm renewal and true-up terms in writing.
Volume-based licensing, no per-user fees
Licenses are based on processed data volume in the active data tier, either per GB per day or in Graylog Compute Units, with no per-user or per-device fees. One GCU equals 20 GB of Security or 25 GB of Enterprise. Data routed to the data lake counts only when retrieved, so ask your vendor how a retrieval-heavy investigation month would be billed before you sign.
Shared 7.2 release line across editions
The 7.2 release line applies to Graylog Open, Enterprise and Security alike, with Graylog 7.2.0 released on October 12, 2026. Edition choice therefore does not change which version you run or how you upgrade the core. Confirm with Graylog which paid features depend on a specific minor release, and plan upgrades against the compatibility matrix for MongoDB and OpenSearch or Data Node.
What the free edition is missing for enterprise needs
Graylog Open has no data tiering, no archive routing and no correlation engine, and those three gaps are where most enterprise evidence and incident response work breaks down. According to the Graylog pricing page, Open does not include hot, warm and archive data tiering or the data lake routing that Enterprise adds, so every log stays in the same index tier until it is deleted. For an evidence collection program, that means a retention decision made for storage reasons also decides what an auditor or incident responder can still query. Open's correlation engine is also absent, so multi-step detections across log sources must be built from event definitions and pipeline logic your team maintains itself.
Access control and accountability are the second gap. Open includes local role-based access control, but SSO and user audit logs are paid features in Enterprise and Security, according to the Graylog pricing page. Without SSO, each analyst account is a local credential that someone must provision, rotate and remove, and without user audit logs you may be unable to show who searched, changed a stream or edited an alert. Check your identity provider's federation options and your own control requirements before assuming local accounts will satisfy them. The Graylog user authentication documentation is the place to confirm which login methods your chosen edition supports.
Retention in Open deletes the oldest indices, and the Graylog index model documentation describes this as the default way storage is managed, so nothing is archived for you. Before go-live, write down the retention period your logging policy requires, calculate storage against it, and decide who copies data out of the cluster before the oldest index is removed. If you will not buy Enterprise, you need a tested export or snapshot process that you own and document. Prebuilt Illuminate detection content is also reserved for the paid editions, so budget engineering time to write and validate every detection your incident response playbooks depend on.
Choosing an edition by team situation
A platform or operations team that mainly needs to collect syslog, GELF and Beats data, search it and build dashboards can often start on Graylog Open. The free edition covers log collection, streams, processing pipelines, search, dashboards, basic triggers, local role-based access control, and Data Node and multi-cluster support. Its alerts can go to PagerDuty, Slack and email through event definitions.
- Core fit: Open covers ingest, routing, search and dashboards with no volume limit.
- Storage limit: Index rotation and retention that deletes the oldest indices are available, but data tiering is not.
- Access control: Local roles only. Teams that depend on LDAP or SSO need a paid edition.
- Support: Community support only, so confirm whether that matches your response expectations.
- Licensing: Open is SSPL-licensed, not OSI open source. Confirm that this fits your internal software policy.
Before buying anything, confirm that your retention needs can be met with delete-oldest index rotation alone, and that local accounts are acceptable for your operators.
A security team that needs to correlate events across sources, act on them with more structure, and sign in through the corporate identity provider usually needs Graylog Enterprise as the minimum edition. Enterprise adds the correlation engine, data tiering across hot, warm and archive tiers, data lake routing, scheduled reports, SSO, teams and LDAP role-based access, and user audit logs. Those last two items are often the deciding factors for access reviews.
- Correlation: The correlation engine is not in Open, so multi-event logic needs Enterprise.
- Identity: SSO and LDAP role mapping are Enterprise features, and Open does not include them.
- Audit trail: User audit logs are Enterprise only, which matters for investigations into who changed what.
- Tiering: Hot, warm and archive tiers may reduce storage cost for older data, but the license counts only data in the active tier.
- Pricing basis: Enterprise starts at 15,000 US dollars per year on the Graylog pricing page, with a minimum of 10 GB per day or 100 Graylog Compute Units.
Before quoting, ask the vendor to show how the correlation engine and SSO map to your identity provider, and model how much of your data stays in the active tier.
A SOC that needs machine learning anomaly detection, detection rules mapped to MITRE ATT&CK, Sigma rule support and automatic case creation is looking at Graylog Security. Security adds identity-based risk triage, watchlists, guided response and AI-generated incident reports on top of the Enterprise features. The pricing page lists it from 18,000 US dollars per year, which is above Enterprise, so the case for the step up rests on detection content and analyst workflow.
- Detection content: MITRE ATT&CK mapped rules and Sigma support are Security features.
- Analytics: Machine learning anomaly detection is not available in Enterprise.
- Workflow: Automatic case creation and guided response reduce manual triage steps.
- Backend: Graylog Security needs OpenSearch 2.0 or later, so confirm the search backend version before sizing.
- Alternatives: Compare the detection content with what your team could build in Enterprise or in OpenSearch Security Analytics.
Before buying, run your own sample of logs through the trial or demo and count how many alerts the MITRE mapping and anomaly detection would have raised that your current rules miss.
What drives the yearly cost of Enterprise and Security
The license is priced on processed data in the active data tier, not on users or devices. Graylog's pricing page lists Enterprise from 15,000 US dollars per year and Security from 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units (GCUs). You can buy either a per-GB-per-day rate or GCUs, where one GCU equals 20 GB of Security or 25 GB of Enterprise. Because the meter counts what lands in hot and warm tiers, your daily ingest and the share you keep in the active tier set the price. Ask the vendor to model your ingest at the 1 to 5 year subscription terms, and ask which data counts toward the license in each tier.
Data routed to the data lake counts against the license only when it is retrieved, and archive retrieval carries no extra license cost for self-managed customers, according to the pricing page. That makes archive routing a lever: moving older, rarely searched logs out of the active tier can lower the metered volume, but each retrieval is metered when it happens. Confirm with Graylog how a large restore or a long historical search is counted, and whether any retrieval thresholds apply to your contract. Your data tier design is therefore a cost decision, not only a storage decision.
The license is only one line of the yearly bill. Graylog server nodes, MongoDB for configuration and metadata, and either Graylog Data Node or self-managed OpenSearch for log storage run on your own infrastructure in every edition, so compute, memory, SSD storage and network capacity recur each year. Graylog's system architecture guidance sizes log storage as daily ingest times retention days times 120 percent, and recommends a message journal of 3 to 5 times daily ingest on SSDs, so storage grows with both volume and retention. Staff time to patch, upgrade and monitor the cluster also recurs, and it is paid to your own team or to a partner under a retainer.
Cost components for each Graylog edition
This table breaks the total cost of a Graylog deployment into its components, showing for Open, Enterprise and Security who is paid, whether each cost is one-time or recurring, and what drives it. Read the subscription row for published starting prices, then use the other rows to build the questions you put in a written quote.
| Cost component | Graylog Open | Graylog Enterprise and Security |
|---|---|---|
| Software subscription | None. Graylog Open is free with no volume limits and community support, per the Graylog pricing page. | Annual subscription. Enterprise starts at 15,000 US dollars per year and Security at 18,000 US dollars per year, per the Graylog pricing page. Recurs yearly for one to five year terms. |
| Data volume driver | No license charge for volume. Your hardware, storage and search backend capacity set the practical limit. | Licensed on processed data in the active data tier, per GB per day or in Graylog Compute Units (one GCU equals 20 GB of Security or 25 GB of Enterprise). Minimum of 10 GB per day or 100 GCUs. |
| Data lake and archive retrieval | Not available. Retention deletes the oldest indices. | Data routed to the data lake counts against the license only when retrieved. Archive retrieval has no extra license cost for self-managed customers, per the Graylog pricing page. |
| Hosting for MongoDB and search backend | Recurring infrastructure cost for MongoDB and Graylog Data Node or self-managed OpenSearch. Scales with ingest and retention. | Same recurring infrastructure as Open, plus any hot, warm and archive tier storage you add. Confirm sizing with Graylog before you buy. |
| Staff time to operate | Recurring. Covers index rotation, retention, pipeline changes, upgrades and monitoring of Graylog and its storage. | Recurring, and often lower for detection content and correlation, since Enterprise and Security include prebuilt parsers, alert rules and detection content. Confirm what you will still write yourselves. |
| Implementation effort | One-time. Installation, input and pipeline design, role setup and sizing, usually scoped in writing before work starts. | One-time, plus integration work for SSO, LDAP teams, correlation rules and MITRE ATT&CK mapped content, which Security adds on top of Enterprise features. |
| Support | Community support only, per the Graylog pricing page. | Enterprise adds 24/7 support according to Graylog product pages. Ask whether support is included in the subscription price or sold separately. |
Moving from Graylog Open to a paid edition and back
The sequence below takes a team from a working Graylog Open deployment to Enterprise or Security without losing data or detections, and shows what changes if the team later steps back down to Open.
Confirm the compatibility matrix for your target release
Before buying anything, the platform owner checks the Graylog compatibility matrix for the target Graylog line (the current documentation covers 7.2) and confirms the supported MongoDB range and search backend. Graylog 7.0 to 7.2 need MongoDB 7.x up to 8.2.x and support OpenSearch from 1.1.x up to 3.7.x, while Graylog Security needs OpenSearch 2.0 or later. If you run OpenSearch 1.x, note that Graylog documents its use as deprecated since 7.0 and removed in Graylog 8.0, so plan a move to Graylog Data Node or a supported OpenSearch version first. Done when every component version is written down and matched against the matrix.
Size the license against processed volume
Someone on the finance and platform side pulls the daily processed volume for the active data tier from current ingest metrics. Graylog licenses are sold per GB per day or in Graylog Compute Units (one GCU equals 20 GB of Security or 25 GB of Enterprise), as annual subscriptions of one to five years, with a minimum of 10 GB per day or 100 GCUs. Ask the vendor how the minimum applies to your volume and whether a multi-year term changes the rate. Done when you hold a written quote tied to a documented volume figure.
Decide which features the paid edition must cover
Security and detection leads list the capabilities that currently block a use case. Enterprise adds data lake routing, hot, warm and archive tiering, the correlation engine, scheduled reports, SSO, LDAP-based roles and user audit logs. Security adds risk triage, machine learning anomaly detection, MITRE ATT&CK mapped rules, Sigma support and AI-generated incident reports. Because Open has no tiering, correlation or SSO, a team needing only one of those can still find the required tier by comparing the feature lists. Done when each requirement maps to a named edition.
Install the paid license and enable features
The Graylog administrator applies the license to the existing server nodes and confirms that Enterprise or Security features appear in the interface. Authentication changes, such as SSO and LDAP role mapping, go into a test environment first, with local administrator access kept as a fallback. Confirm the search backend and MongoDB still match the compatibility matrix after the license change. Done when a test user can sign in through the new method and the paid views load on every node.
Migrate retention and index settings
The platform engineer reviews the index rotation and retention settings that Open applied by message count, size or time, then decides which indices should move to hot, warm or archive tiers under Enterprise or Security. Retention that deletes the oldest indices has to be restated for each tier so data is not removed earlier than the compliance or investigation policy requires. Confirm archive retrieval behavior with the vendor, since the pricing page says data routed to the data lake counts against the license only when retrieved. Done when a documented retention table matches the policy owner's sign-off.
Rebuild alert definitions as paid detections
The detection engineer exports the event definitions and notifications configured in Open, which send alerts to channels such as PagerDuty, Slack and email, and recreates them where the paid edition offers correlation, Graylog-maintained alert rules or Sigma rules. Test each rule against historical data and confirm that the notification path still reaches the on-call team. Keep the Open definitions active until the new ones have fired on a known test event. Done when every legacy alert has a matching paid rule and a recorded test result.
Plan the reverse path before relying on paid features
Before the team depends on paid features, the platform owner records what Graylog Open would lack after a downgrade: data tiering, the correlation engine, SSO and user audit logs. Graylog Open keeps local role-based access control, so accounts must be recreated locally and audit history from paid periods should be exported and archived separately. Ask the vendor how a downgrade is handled, including license expiry, and test it in a non-production environment. Done when a written downgrade runbook lists each lost feature and its replacement.
Questions buyers ask before choosing a Graylog edition
Is Graylog Open enough to produce SOC 2 style evidence?
Graylog Open can collect, search and retain logs, so it can supply some of the raw log evidence an auditor may ask for. It does not include user audit logs, SSO or the correlation engine, which many teams need to show who changed access and how alerts were handled. Whether the evidence is sufficient is a decision for your auditor and your control owner, not for the software. Ask the auditor which logs and alert records they expect to sample, then check whether Open produces them in your environment. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports or attestations.
How long does it take to set up a Graylog Enterprise evaluation or purchase?
No timeline for setup or procurement is supplied for Graylog Enterprise, so confirm the lead time with Graylog directly. The paid editions are annual subscriptions for one to five years, with a minimum of 10 GB per day or 100 Graylog Compute Units, so the sizing and contract term are the first decisions. Setup time then depends on how many inputs, streams and pipelines you migrate and whether you run Data Node or your own OpenSearch cluster. DeployOpen scopes implementation work in writing before it starts, and timelines are agreed in that scope.
How much in-house effort does each Graylog edition need to run?
The edition changes the feature set more than the day-to-day operating work. Every edition runs Graylog server nodes, MongoDB for configuration and a search backend, so someone must patch, back up and monitor those parts. Enterprise adds data tiering, archive handling and scheduled reports to administer, and Security adds risk triage, case creation and anomaly detection that need analysts who understand them. The Graylog multi-node guide recommends three Graylog and MongoDB nodes and three Data Nodes, so a clustered layout multiplies that work. Ask your team to size these tasks before choosing an edition.
Is upgrading from Graylog Open to a paid edition an in-place change?
Graylog's edition and license model is designed around one product line, so moving from Open to Enterprise or Security is typically a license change applied to a running system rather than a reinstall. Confirm this with Graylog for your exact version before you rely on it. Your version also matters, because the compatibility matrix states that Graylog 7.0 to 7.2 need MongoDB 7.x up to 8.2.x, and use of OpenSearch 1.x is deprecated since Graylog 7.0 and will be removed in Graylog 8.0. Plan any search backend upgrade separately from the license change.
What does a fixed-scope Graylog implementation from DeployOpen cover?
A fixed-scope engagement covers the work listed in a written statement of scope, with deliverables and timelines agreed before work starts. For a Graylog project, that can include planning the deployment, installing and hardening the platform in your own infrastructure, building inputs, streams, pipelines and alerts, integrating notifications, documenting the system, and setting up backup and upgrades. Edition-specific items such as data tiering or Security rules appear in scope only when you have licensed them. DeployOpen does not publish a price list, so a quote follows from the written scope.
Do Graylog Security's MITRE ATT&CK rules need a dedicated SOC team?
Graylog Security includes detection rules mapped to MITRE ATT&CK, Sigma rule support, machine learning anomaly detection, automatic case creation and AI-generated incident reports. Those features produce more alerts and cases, and someone must triage them, tune them and decide what to escalate. A dedicated SOC is not a stated requirement in the product material, but a team with someone responsible for alert review and rule tuning is the practical minimum. If you have no one who can own that queue, the higher yearly price of Security may not return value, and Enterprise may be the better fit.
What drives the yearly cost of Graylog Enterprise or Security?
Graylog licenses processed data volume in the active data tier, either per GB per day or in Graylog Compute Units, where one GCU equals 20 GB of Security or 25 GB of Enterprise. Enterprise starts at 15,000 US dollars per year and Security at 18,000 US dollars per year, according to the Graylog pricing page. Data routed to the data lake counts against the license only when retrieved, and archive retrieval carries no extra license cost for self-managed customers. Your daily ingest volume and how much you keep in the hot tier are therefore the main cost drivers. Ask Graylog for a quote based on your measured ingest.
How DeployOpen scopes and supports either Graylog edition
Whichever Graylog edition you choose, DeployOpen plans, implements, hardens, backs up and documents the self-hosted deployment inside your own cloud accounts, data centers or air-gapped network. The work is usually sold as a fixed scope, with deliverables and timelines agreed in writing before anything starts. For a Graylog Open build, that scope typically covers the Graylog server nodes, the MongoDB configuration store, the search backend (Graylog Data Node or self-managed OpenSearch within the versions listed in the Graylog compatibility matrix), inputs, streams, pipelines, index retention and the event definitions behind alerts. For Enterprise or Security, the scope also includes licensing the data volume in the active tier, configuring SSO and audit logging, and validating any paid detection content before it is switched on.
Ask each vendor you are evaluating which parts of that scope you will own afterward. A reasonable written scope names who performs each upgrade step, who holds the Data Node or OpenSearch certificates, who reviews audit log retention and who runs restore tests for backups. Confirm the backup and restore responsibilities in writing before work begins, because they differ between a single-node test system and a multi-node production cluster. Ongoing support, upgrades and continuous testing are available as retainers, so you can decide whether to keep those tasks in-house or move them to a retainer after the initial build.
DeployOpen does not publish a price list. A quote follows from the written scope, so the cost drivers are the ones you define: the number of Graylog and MongoDB nodes, the Data Node or OpenSearch cluster size, the number of inputs and pipelines, the SSO and audit integrations, and the hardening baseline you require. DeployOpen also does not issue audit reports, attestations or certifications. It can prepare systems, controls and evidence for a compliance assessment, but an independent auditor or certification body must perform the assessment. DeployOpen is not an official Graylog partner, reseller or certified provider.
