Graylog vs ELK Stack vs Loki: which to choose

Graylog vs ELK Stack vs Loki: which fits your log management team

Choose Graylog if your security team owns log monitoring and wants streams, pipelines, event definitions and alerting in one product, and you can accept that Graylog Open is SSPL-1.0 licensed, which the Open Source Initiative does not approve. Choose the Elastic Stack if you want the most configurable search and dashboards, your team can build its own pipelines in Logstash or Elastic Agent, and you are willing to pay for Platinum or Enterprise features such as single sign-on in the self-managed tiers. Choose Loki if a platform team already runs Grafana and object storage, wants low-cost label-based storage, and accepts that Loki has no built-in authentication layer and needs an authenticating reverse proxy in front of it. Loki is AGPLv3, which is OSI approved.

The license question is the first filter. Graylog Open uses SSPL-1.0 and Graylog Enterprise and Graylog Security are paid editions, with Graylog Enterprise listed from 15,000 US dollars per year on the Graylog pricing page. The Elastic Stack offers three source licenses (ELv2 as the default distribution, SSPL 1.0 and AGPLv3), so the license you get depends on which distribution you pull. Loki is AGPLv3 throughout. Your legal team should confirm which of these licenses it will accept for internal hosting before any technical evaluation begins.

The second filter is who operates the platform. Graylog stores configuration in MongoDB and indexes logs in OpenSearch or Graylog Data Node, so a security team needs to staff both layers, and it should confirm the supported MongoDB and search backend versions in the Graylog compatibility matrix for its target release. Loki trades full-text indexing for object storage and a compactor that is disabled for retention until you enable it, which suits platform teams that already run that stack. Confirm with your own engineers which set of skills you can staff for the next several years before you commit.

Which platform fits which team and scenario

This table matches each common team situation to the platform that fits it best, with the supplied fact behind the choice and the condition under which another option would win. Read it as a shortlist filter: start with your licensing rule and your query pattern, then check the operating skills you already have.

Scenario	Best fit	Why, and when the others win
Security team needing indexed search, alerts and fast investigation	Graylog	Graylog stores logs in an indexed search backend and alerts through event definitions that can notify PagerDuty, Slack and email. Correlation, archive restore and prebuilt detection content sit in paid Enterprise or Security editions. Loki wins if queries are mostly label lookups over long retention, and the ELK Stack wins if your team wants to build its own Kibana detections.
Platform team with existing Kibana and Elasticsearch skills	ELK Stack	Your team already runs Elasticsearch and Kibana, so the operating model, node roles and dashboards carry over directly. Confirm which features you need are in the Basic tier, since SSO, field-level security and anomaly-based alerting are paid. Graylog fits if you want its inputs, streams and pipelines without building them yourself.
Strict OSI-approved license requirement	Grafana Loki	Loki is licensed under AGPLv3, which is OSI approved. Graylog Open is SSPL-1.0, which is not OSI approved, and ELv2 is not OSI approved either. The ELK Stack can meet the requirement only if you choose the AGPLv3 option for Elasticsearch and Kibana, so confirm that with Elastic before you rely on it.
High-volume, low-query logs on object storage	Grafana Loki	Loki stores compressed chunks and its index in object storage and recommends S3, Google Cloud Storage or Azure Blob Storage for production. Retention is disabled by default, so you must set it deliberately. Graylog or the ELK Stack fit better if analysts run frequent full-text searches across large histories, since those workloads depend on the indexed backend.
Team needing a single supported path with vendor-backed SIEM content	Graylog (paid edition)	Graylog Security adds risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content. Pricing starts at 18,000 US dollars per year on the Graylog pricing page, with a 10 GB per day or 100 Graylog Compute Units minimum. Stay on Open or choose the ELK Stack if that budget or license model does not fit.
Platform team running a mixed Kubernetes and service fleet	Grafana Loki	Loki accepts logs from Grafana Alloy, Fluent Bit, Fluentd, the Docker logging driver and OpenTelemetry over HTTP. It has no built-in authentication, so you must place an authenticating reverse proxy in front of it. Choose Graylog if your team needs a built-in web interface for security analysts from day one.
Cost of operating multiple storage layers	Grafana Loki	Graylog needs MongoDB for configuration and a search backend such as Data Node or OpenSearch, and it recommends multi-node layouts for larger deployments. Loki needs object storage and a compactor. The ELK Stack needs a multi-node Elasticsearch cluster with at least three master-eligible nodes for high availability. Confirm total effort with each vendor's sizing guidance for your ingest rate.

How indexing choices change storage and query cost

Full-text indexing and label-based indexing store logs in fundamentally different ways, and that difference sets your storage bill and your query speed. Graylog on OpenSearch or Graylog Data Node, and Elasticsearch, index the content of every message so that any term can be searched quickly. That index sits on fast disk alongside the data, so storage cost grows with both ingest volume and retention. Graylog's system architecture guidance gives a planning formula of daily ingest multiplied by retention days multiplied by 120 percent, which is a useful starting point for disk sizing. Graylog also recommends a message journal of 3 to 5 times daily ingest on SSDs, so the write path needs fast local disk before any data reaches the search backend. Confirm these figures against your own message sizes and replica settings before you buy hardware.

Loki takes the opposite approach. It indexes only labels, such as the application or host a stream came from, and stores the compressed log chunks in object storage such as Amazon S3, Google Cloud Storage or Azure Blob Storage. Because the message text is not indexed, storage is generally cheaper per retained gigabyte, but queries that filter on text must scan the chunks within the selected label set, so query cost depends on how well your labels narrow the search. Loki recommends TSDB as the index store for version 2.8 and newer, and older stores such as DynamoDB, Bigtable and Cassandra are deprecated, so a new deployment should confirm it is using TSDB. Label cardinality is the main cost lever: every distinct label combination creates more streams and more index entries, so ask your team to review label design before scaling ingest. What drives cost up or down therefore differs by platform. For Graylog and Elastic-style stacks, the main levers are retention days, index replicas, shard layout and the search backend node count, and the Graylog multi-node guidance adds MongoDB and a load balancer around that. For Loki, the levers are label discipline, retention settings applied by the compactor, and the object store contract. Retention is disabled by default in Loki, so logs persist until you set it, which is a risk to plan for in both cost and compliance terms. Ask any vendor or implementation partner to model storage for your actual ingest, retention and query patterns in writing, and to state which assumptions it uses.

What each license and paid tier actually includes

Graylog Open has been licensed under the Server Side Public License version 1 (SSPL-1.0) since Graylog 4.0 in 2020, replacing the GPL v3 used by earlier releases. SSPL is not approved by the Open Source Initiative, so if your policy requires OSI-approved licenses, Graylog Open does not meet it regardless of price. The free edition has no volume limits and comes with community support. Paid features sit in two commercial editions, Graylog Enterprise and Graylog Security.

Free edition: Graylog Open covers ingest, streams, processing pipelines, search, dashboards and event-based alerting.
Paid archive and correlation: Index archiving, the correlation engine, reporting and 24/7 support are in Graylog Enterprise or Graylog Security, not Graylog Open.
Prebuilt detection content: Illuminate detection content is part of the paid editions.
Pricing model: Paid editions are licensed on processed data with no per-user or per-device fees, with a stated minimum tier.
Version scope: Graylog 7.2 is the current release line in the supplied sources.

Confirm with Graylog whether your use of SSPL-licensed code, including modified or hosted use, meets your legal review, and ask for the current Enterprise and Security price in writing.

What drives the running cost of each platform

Licence fees are only part of what each platform costs to run. The biggest differences come from how much data you keep, which paid tier you need for security features, and who on your team carries upgrades and hardening. Use these cards to shape the questions you put to each vendor and to your own engineers before you sign anything.

Storage volume and retention

Storage is usually the largest recurring cost in all three platforms. Graylog sizes log storage as daily ingest times retention days times 120 percent, and Graylog Open retention deletes the oldest indices, so every extra day of search-hot data is paid for on OpenSearch or Data Node nodes. Loki keeps compressed chunks in object storage, which is typically cheaper per gigabyte, but its compactor only deletes data once retention is enabled. Ask each vendor or partner to model your daily ingest and the number of days you must search quickly, not just the number of days you must keep.

Graylog paid edition fees

Graylog Open has no licence fee, but correlation, archive restore, data tiering and prebuilt detection content sit in paid editions. The Graylog pricing page lists Graylog Enterprise from 15,000 US dollars per year and Graylog Security from 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units, licensed on processed data. Ask whether your daily volume sits above that minimum, how the fee is calculated at your ingest, and whether the quote covers support tiers and renewal uplifts.

Elastic subscription tiers

Elastic's free Basic tier includes TLS, file and native realms and role-based access control, but single sign-on, Active Directory and LDAP authentication and field- or document-level security sit in paid tiers. The detection engine and machine learning anomaly detection were under Platinum, which is no longer sold to new customers, so the current paid path is Enterprise. Confirm exactly which security and detection features your team needs, then ask Elastic or a partner which subscription covers them and how it is priced for your node count.

Loki object storage and compactor operation

Loki's licence is free, but its running cost moves to object storage, the compactor and the authenticating reverse proxy you must place in front of it, because Loki has no built-in authentication. Simple scalable deployment is being deprecated and will be removed in Loki 4.0, so a team sizing for growth should confirm which deployment mode its roadmap supports. Budget for the engineer time to tune compaction, watch retention and maintain the proxy, and ask any partner to state which of these tasks sit in scope.

Staffing for upgrades and hardening

Self-hosting moves recurring labour to your side or to a partner's retainer. Graylog needs MongoDB, Data Node or OpenSearch and server nodes kept on compatible versions, with OpenSearch 1.x use deprecated since Graylog 7.0 and due for removal in Graylog 8.0. The ELK stack needs Elastic version support tracked against end-of-life dates, and any SSO, TLS and role hardening is your work on the free tier. Ask who patches each component, who tests upgrades in a non-production cluster and whether upgrade and hardening sit in a fixed-scope engagement or a retainer.

Cost of switching later

Moving between these platforms is expensive because each stores data and rules differently. Graylog streams, pipelines and event definitions do not map directly onto Kibana objects or Loki label queries, and historical indices or chunks often need to be re-ingested or exported rather than moved in place. Before choosing, ask how each option exports rules and dashboards, how long you would keep parallel pipelines running during a cutover and what that parallel run would cost in storage and staff time.

What implementing each platform involves

Graylog is the most component-heavy of the three to stand up at scale. A Graylog deployment combines Graylog server nodes, a MongoDB instance for configuration and metadata, and a search backend, which Graylog recommends as Graylog Data Node. For medium to large deployments, the multi-node guide describes three Graylog and MongoDB nodes with MongoDB as a replica set, three Data Nodes on their own cluster, a load balancer, and is_leader set to false on follower Graylog nodes. Decide early whether your team will run its own OpenSearch cluster or let Data Node manage it. If you choose self-managed OpenSearch, confirm the supported version range in the Graylog compatibility matrix for your target release. OpenSearch 1.x use is deprecated since Graylog 7.0 and will be removed in Graylog 8.0, so an OpenSearch 1.x cluster is a migration you will have to schedule, not a stable choice.

The Elastic Stack leaves more of the design to you. Elasticsearch node roles include master-eligible, data (with hot, warm, cold and frozen tiers), ingest, machine learning, transform, remote cluster client and coordinating-only, and a highly available cluster needs at least three master-eligible nodes. Logstash or Elastic Agent pipelines, index lifecycle policies, Kibana and the parsing rules for each log source are your work, and none of it comes preconfigured. Plan for the pipeline before the cluster: which sources feed which index templates, how long each tier keeps data, and who owns parser changes after go-live. If you run Kubernetes, check whether Elastic Cloud on Kubernetes fits your operating model, and confirm which of its tiers your use requires.

Loki has the smallest set of moving parts, but the choices it leaves you are consequential. Start with the deployment mode: the Loki documentation describes monolithic mode for up to about 20 GB of logs per day, and simple scalable mode for larger volumes, but it states that simple scalable is being deprecated and will be removed with Loki 4.0, so avoid designing new clusters around it. Object storage is required for production, and the recommended options are Amazon S3, Google Cloud Storage and Azure Blob Storage. Retention is disabled by default, so logs are kept indefinitely until retention_enabled is set on the compactor, and stream rules must be at least 24 hours. Loki also has no built-in authentication, so you must place an authenticating reverse proxy such as nginx, HAProxy, OAuth2 Proxy or Pomerium in front of it, and multi-tenant setups depend on auth_enabled and the X-Scope-OrgID header. Budget that proxy and its identity integration as part of the implementation.

How to choose in four steps

This sequence turns a shortlist of three log platforms into one defensible choice by checking license terms first, then who will use the platform, then the storage footprint, and finally the edition and operating model.

Confirm your license requirement first
Before any feature comparison, decide whether your organization can run non-OSI licenses. Graylog Open is SSPL-1.0, the Elastic default distribution is Elastic License 2.0, and the Elastic Stack also offers SSPL 1.0 and AGPLv3 options, while Loki is AGPLv3. Your legal or procurement team should read the LICENSE file in each repository and confirm whether the license fits internal policy and any managed-service plans. The output is a written list of acceptable licenses that removes options before you spend time on testing.
Name the primary user of the platform
Decide whether security analysts or platform engineers will own day-to-day use. Analysts usually need indexed search, streams, alerting and detection content, which points toward Graylog or the Elastic Stack with the right tier. Platform engineers who mainly query operational logs by label and already run object storage may fit Loki better. Hold a short review with both groups and record which tasks each must perform weekly. The output is a named owner and a task list that the candidates must support.
Size ingest and retention with the supplied formulas
Estimate daily ingest in gigabytes from your current log sources, then apply the Graylog system architecture formula of daily ingest multiplied by retention days multiplied by 120 percent for log storage, and plan the message journal at 3 to 5 times daily ingest on SSDs. For Loki, confirm the deployment mode against your daily volume using the Loki deployment mode documentation, since monolithic mode is documented for up to about 20 GB per day. Ask each vendor or partner to price the same ingest and retention figures in writing. The output is one sizing sheet that all three platforms are measured against.
Map the required features to editions
List the features you cannot do without, such as archive restore, data tiering, correlation, SSO, audit logs or detection content. Check which edition includes each one: Graylog Enterprise and Graylog Security are paid, Elastic places SAML and OpenID Connect single sign-on and detection features in paid tiers, and Loki has no built-in authentication and needs an authenticating reverse proxy. Confirm current prices and terms directly with each vendor, since you should not rely on a secondhand figure. The output is a feature-to-edition matrix that shows the real annual cost of each shortlisted option.
Pick the platform and confirm the operating model
Choose the platform whose license, user fit, sizing and edition costs hold up across the earlier steps, then confirm the operating model. Graylog needs MongoDB and a search backend, and Graylog recommends Data Node for storage. The Elastic Stack needs cluster roles and at least three master-eligible nodes for high availability. Loki depends on object storage and a compactor for retention. Ask a delivery partner to scope installation, hardening and upgrades in writing before work starts. The output is a short decision record with the chosen platform, edition and signed-off scope.

Questions buyers ask before hiring help with log management

What does a self-hosted log management implementation cost?

The cost is driven by the work you hand to a partner and the infrastructure you run it on, not by a list price. Expect separate components: the design and sizing work, installation and integration with your sources, detection and alert content, hardening, backup and upgrade procedures, and documentation. Infrastructure is a separate line: compute, storage for indexed data, object storage if you choose Loki, and the search or database tier. Software licensing adds a further line if you choose a paid Graylog or Elastic edition, where the Graylog pricing page lists Graylog Enterprise from 15,000 US dollars per year and Graylog Security from 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units. Ask any vendor for a written scope that separates one-time work from recurring retainers and licence fees.

How long does a log management deployment take, and what sets the duration?

Duration depends on scope, the number of log sources, the number of environments and how much detection content you need on day one. No single timeline applies across these platforms, so ask for a schedule tied to a written scope. The biggest drivers are the number of sources that need parsers or pipelines, whether you need a multi-node layout, how many approval gates your change process has, and how much evidence your compliance team needs. Graylog's multi-node guide calls for three Graylog and MongoDB nodes, three Data Nodes and a load balancer, which adds work compared with a single node. Elastic's self-managed tiers and Loki's storage choices carry their own configuration steps. Agree on acceptance criteria, such as ingest rate and search response, before the schedule is fixed.

Can our team run a log management platform without a partner?

Yes, many teams run these platforms in-house, but the decision depends on skills and staffing rather than on the product alone. Each option needs people who can manage a search or storage tier, certificates, upgrades, backups and capacity. Graylog runs server nodes with MongoDB for configuration and Data Node or self-managed OpenSearch for storage, so it asks for database and search skills. Loki depends on object storage and an authenticating reverse proxy, because Loki has no built-in authentication layer. Elastic requires cluster operations and, for SSO or endpoint features, a paid subscription. Be honest about on-call coverage. If one person holds all the knowledge, a retainer or documented runbooks reduce that risk.

What does the work need from our internal team?

Plan for named owners on the infrastructure, the platform and the detection content. Infrastructure owners provision hosts or cloud accounts, manage networking, and approve storage and retention settings. Platform owners handle installation, upgrades and access control. Detection owners decide which events matter and tune alerts so the team does not drown in noise. Your team will also supply log source access, identity integration details, change windows and sign-off on the security baseline. Graylog's documentation advises sizing storage as daily ingest multiplied by retention days and 120 percent, and giving the message journal 3 to 5 times daily ingest on SSDs, so someone must own capacity numbers from the start. Ask your partner which of these tasks they perform and which stay with you.

Which log management license is OSI approved?

None of the Graylog Open, Elastic default or Security Onion licenses discussed here is OSI approved. Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0) since Graylog 4.0, which the Open Source Initiative does not approve. Elastic's default distribution uses the Elastic License 2.0, which is also not OSI approved, but Elastic added AGPLv3 in September 2024 before the 8.16 release to offer an OSI-approved option. Grafana Loki is licensed under AGPLv3, which is OSI approved. Confirm the exact license of each component you plan to deploy, because a stack can mix licenses across its parts, and have your legal team review the terms for managed-service use.

When does Graylog Enterprise or Elastic Enterprise become necessary?

Move to a paid tier when a capability you need is only in that tier. For Graylog, the documentation places index archiving, correlation, reporting and prebuilt Illuminate detection content in Graylog Enterprise or Graylog Security, so teams that need those features will pay for them. Graylog Enterprise adds a data lake with archive restore, data tiering and 24/7 support, and Graylog Security adds risk scoring, anomaly detection and compliance packs. For Elastic, single sign-on with SAML or OpenID Connect and endpoint malware prevention sit under the Enterprise subscription, and the Platinum tier is no longer sold to new customers. Map each requirement, such as SSO, audit retention or archive restore, to the tier that provides it before you commit.

What should we ask for in a quote for log management help?

Ask for a written scope listing each platform, each log source, each environment and each deliverable, because scope drives both cost and duration. Request separate line items for design, installation, integration, detection content, hardening, backup and restore testing, upgrades and documentation. Ask which items are one-time and which are recurring, such as a support retainer or upgrade cycle. Confirm which software licenses are included, which the client buys directly, and what infrastructure the client provides. Ask how the partner handles change control, what evidence they hand over, and how they treat out-of-scope requests. DeployOpen works from a written scope, and its quote follows from that scope rather than from a published price list.

Where to confirm the license, release and compatibility details

Start with the license, because it decides what you can run without a commercial agreement. For Graylog, read the LICENSE file in the Graylog2/graylog2-server repository, which shows that Graylog Open has been under the Server Side Public License version 1 (SSPL-1.0) since Graylog 4.0. Then check the Graylog pricing page for current Enterprise and Security terms, and confirm the minimum data volume and whether the price you are quoted applies to processed data. For the Elastic Stack, the licensing FAQ explains the three source license options (ELv2, SSPL 1.0 and AGPLv3), and the subscriptions page shows which features sit in the Basic, Platinum and Enterprise tiers. For Loki, confirm the AGPLv3 terms directly with the Grafana Labs licensing page before you assume any feature is open.

For compatibility and deployment, use the version-specific pages rather than summaries. Check the Graylog compatibility matrix for the MongoDB and search backend versions that match your target Graylog release, and confirm whether OpenSearch 1.x is still supported on the release you plan to run. For Elastic, confirm the end-of-life dates on the Elastic product end of life page before choosing a release line, and check the node roles documentation for master-eligible node counts. For Loki, confirm the deployment mode, the object store and the retention settings against the Loki deployment modes, storage and retention pages, and verify that the simple scalable mode you are considering is not on the deprecation path. Write these checks into your evaluation plan and ask DeployOpen or the vendor to confirm them in writing against the release you intend to deploy.

How DeployOpen helps choose and implement a log platform

DeployOpen helps teams decide between Graylog, the Elastic Stack and Grafana Loki, then plans and implements the option that fits the license terms, storage model and operating skills in your own infrastructure. The work is scoped in writing before any build starts, so the decision and its consequences are documented first.

How we scope

Written scope lists which platform or platforms are in play, and which log sources, volumes and retention periods the design must handle.
We confirm the license and edition questions for your team, including which features sit in paid Graylog or Elastic tiers.
Scope names who operates the platform after go-live, so the design matches your staffing rather than an assumed one.

How we build

We plan storage for your chosen backend, whether MongoDB with OpenSearch or Data Node for Graylog, Elasticsearch nodes, or Loki object storage.
We configure inputs, parsing, retention and alerting, then test ingestion, search and notification paths against your real sources.
Authentication and access controls are built and tested, including reverse proxy placement where the platform does not provide it on its own.

How we hand over

Deliverables include architecture notes, configuration records, runbooks for index or chunk retention, and backup and restore procedures.
We document the license and edition choices made, so later procurement and audit questions have a written answer.
Handover sessions walk your operators through daily checks, upgrade steps and the failure cases the design was built around.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the build.
Upgrade plans follow each vendor's published support windows, which we confirm with you before any change is scheduled.
Quotes follow from the written scope, so ask us to itemize build, handover and retainer work separately.

Graylog vs ELK Stack vs Loki