What a Graylog cost of ownership review covers
A Graylog cost of ownership review is a structured analysis of what the platform will cost to run and which edition fits your log volume, separate from the rollout itself. It answers the question before any build starts: is Graylog Open enough, or does the business case justify Enterprise or Security? Teams usually open a review when a licensing renewal approaches, when log volume jumps, when they plan to move off Splunk or an ELK stack, or when someone proposes a paid edition purchase.
Graylog Open is free with no volume limits and community support. Graylog Enterprise and Graylog Security are subscriptions priced on processed data, with a published starting price and a minimum of 10 GB per day or 100 Graylog Compute Units. Confirm current figures on the Graylog pricing page, because the subscription cost scales with what you process, not with user or device counts. The platform fee is only one line. A complete review also models MongoDB, Data Node or self-managed OpenSearch storage, retention length, the server nodes needed for resilience, and the admin hours to patch, upgrade and tune the system.
The output is a written model that lists each cost component, who pays for it, which items are one-time and which recur, and which inputs move the total most, such as daily ingest, retention days and the number of high-availability nodes. It should also name the edition features your team needs, including Enterprise items such as archive restore, data tiering and 24/7 support, and Security items such as SIEM analytics and compliance packs, so you do not buy capacity for features you will not use. Ask for each assumption to be stated in the output so finance and security can challenge it.
Most organizations build this model in-house, using their own log volume data and vendor price sheets, and bring in a partner when the decision is large or contested. A partner is useful when you lack reliable volume measurements, need an independent comparison of Graylog against Splunk or ELK, or want the model tested against a sized architecture. Whichever route you choose, agree the scope, assumptions and deliverables in writing before the work begins.
What the review includes and what you receive
The review produces a cost model and edition recommendation built from your own log sources, volumes and retention needs. Scope, deliverables and timelines are agreed in writing before any work starts.
Log source and daily volume inventory
We list each log source, its collection method and its average and peak daily ingest. Graylog Enterprise and Security are licensed on processed data, so this inventory is the main input to the subscription cost. Ask whether volumes are measured before or after parsing and filtering, because that choice changes the licensed figure.
Retention requirements by log type
We map each log type to the retention period set by policy, contract or regulation, and to the index sets that will hold it. Retention multiplies storage, so a single longer period for one noisy source can drive the Data Node sizing more than any other choice. Confirm retention with your compliance owner before modeling.
Edition fit across Open, Enterprise and Security
We compare the features you need against Graylog Open, Graylog Enterprise and Graylog Security, including data tiering and archive restore, SIEM content, and single sign-on options. Each feature gap is priced against its own cost, so you can see which requirement justifies a paid edition. Confirm current feature lists with Graylog, since they change between releases.
Infrastructure sizing for storage and MongoDB
We size the Data Node or self-managed OpenSearch cluster from daily ingest and retention, and size the MongoDB replica set and the message journal on SSDs. The Graylog architecture guidance uses daily ingest times retention times 120 percent as a starting point for storage. Ask for the sizing assumptions, the node counts and the hardware or cloud rates used, so you can rerun the numbers yourself.
Admin effort estimate
We estimate the recurring operator time for patching, index management, upgrades, user and role administration, and on-call alert handling. This effort is usually the largest cost that does not appear on an invoice. Compare the estimate against the staff hours you can assign, and state the assumptions behind it.
Three-year cost model workbook
We deliver a workbook that separates one-time costs, such as implementation and hardware, from recurring costs, such as subscriptions, infrastructure and admin time, over a three-year or other agreed horizon. Each line shows its driver, so changes in volume, retention or edition can be tested. Agree the horizon and currency before the model is built.
Edition recommendation memo and open decisions
We deliver a memo that recommends an edition and states the reasons, the risks of the choice and the alternatives considered. Open decisions list items that need input from your team, such as retention sign-off, volume growth, or identity provider choice. The quote-ready scope list then converts the agreed decisions into the work to be priced.
What drives Graylog running cost
This table lists the main drivers of Graylog running cost, why each one moves cost or effort, and how to keep it under control.
| Driver | Why it moves cost | How to keep it down |
|---|---|---|
| Daily processed volume | Enterprise and Security are licensed on processed data, with a minimum of 10 GB per day or 100 Graylog Compute Units. | Filter noise and drop unneeded fields in pipelines before indexing. Confirm the volume basis in writing. |
| Retention length and index rotation | Longer retention multiplies stored data. Rotation by message count, size or time controls index size. | Use separate index sets per log type with their own retention. Use Enterprise tiering for older data. |
| Storage on Data Node or OpenSearch | Storage follows daily ingest times retention days times 120 percent, per Graylog architecture guidance. | Model the total for your retention period, then confirm replica and snapshot space with your storage team. |
| Message journal on SSDs | Graylog advises a journal of 3 to 5 times daily ingest on SSDs, which adds disk on each Graylog node. | Size the journal for the ingest each node receives and confirm disk headroom before go-live. |
| MongoDB and node count | The multi-node guide recommends three Graylog and MongoDB nodes plus three Data Nodes for medium to large deployments. | Confirm availability requirements first. A smaller design saves servers but changes failover behavior. |
| Enterprise features | Data lake with archive restore, data tiering, correlation engine and 24/7 support come with Enterprise. | Price these only if your retention or response model needs them. Compare against Open retention first. |
| Security features | Adds investigations, compliance packs, risk scoring and threat detection content. Needs OpenSearch 2.0 or later. | Confirm which features your SOC will use before choosing Security over Enterprise. |
| SSO requirements | Okta, OpenID Connect and SAML single sign-on are Enterprise features. Open supports AD and LDAP. | If identity runs on SAML or OIDC, plan for Enterprise early. Confirm group-to-role mapping needs. |
| Admin effort for pipelines and content | Pipeline rules, extractors, lookup tables and dashboards need ongoing tuning and testing time. | Reuse content packs, test rules in staging and document ownership to limit recurring effort. |
How a cost review runs
The sequence turns measured log volume, retention and edition requirements into a cost model that supports a fixed-scope quote.
Inventory log sources and retention
DeployOpen works with your team to list each log source, its daily volume and how long each log type must stay searchable and be kept. Ask your team to confirm actual daily ingest measured from current logging tooling. The output is a source register and volume baseline that every later step uses.
Map edition features to requirements
Each requirement, such as SSO method, data tiering, archive restore, correlation, SIEM content or 24/7 support, is matched against Graylog Open, Enterprise and Security. Confirm which authentication methods and compliance needs are mandatory. The output is a feature matrix with the edition options that meet every mandatory requirement.
Model infrastructure and storage
The baseline is used to size server nodes, MongoDB, the Data Node or self-managed OpenSearch cluster, and the message journal. Graylog's architecture guidance sizes log storage as daily ingest times retention days times 120 percent and suggests a journal of 3 to 5 times daily ingest on SSDs. The output is a topology and storage sizing per environment.
Estimate staffing and admin effort
The review lists the recurring operational work: patching, upgrades, index rotation, parsing rules, dashboards, alert tuning and onboarding new sources. Each task is assigned to your team, a partner or a retainer. Confirm who holds on-call duties and the available hours. The output is an effort model by role.
Build the one-time and recurring cost model
One-time lines cover design, build, migration and customization. Recurring lines cover infrastructure, storage, licensing, support and admin time. Graylog's pricing page states that Enterprise and Security licenses are based on processed data with a minimum of 10 GB per day or 100 Graylog Compute Units. The output is a cost model that separates each line, the payee and the cost drivers.
Review decisions and request a quote
The model is walked through with the decision makers, who confirm assumptions, edition choice and phasing. Open items are closed in writing. The output is a written scope and quote request, which DeployOpen answers with a fixed-scope quote agreed in writing before any work starts.
Which cost work teams keep and which they outsource
This table compares in-house and outside provider ownership for each Graylog cost task, with the skills each task needs and where an outside view adds the most value.
| Cost task | Skills required | Usually done in-house | Where an outside view helps |
|---|---|---|---|
| Volume measurement | Platform engineering, security operations | Listing log sources by type and reading current daily ingest from source systems and Graylog statistics. | Checking how peak and average ingest map to the processed data and minimum volume terms on the pricing page. |
| Edition feature mapping | Security operations, platform engineering | Listing required features such as SSO, archiving, data tiering and SIEM content against each edition's product pages. | Confirming current edition inclusions in writing before a purchase decision, since product pages change between releases. |
| Storage and MongoDB sizing | Linux and storage administration, MongoDB | Applying the daily ingest times retention times 120 percent rule and the journal guidance of 3 to 5 times daily ingest. | Validating replica set layout, Data Node or OpenSearch versions and disk sizing against the compatibility matrix for your target release. |
| Licensing review against SSPL-1.0 | Legal or compliance, procurement | Reading the LICENSE file and recording which internal and hosted uses your organization plans. | Obtaining legal advice on SSPL-1.0 obligations, since the license is not OSI-approved and terms apply to how Graylog is offered. |
| Procurement and vendor negotiation | Finance or procurement, platform leadership | Comparing quoted annual figures with expected processed volume, minimums and included support. | Reviewing quote scope and renewal terms with a negotiator who has handled comparable software purchases. |
| Ongoing admin effort model | Platform engineering, security operations, MongoDB | Tracking 7.x minor upgrades, index rotation, alert tuning and on-call coverage for each month of operation. | Testing the hours model against a sample upgrade cycle and asking any outside provider for a written support scope. |
How the cost picture changes by starting point
Graylog Open has no license fee and no volume limit, so the recurring cost is the infrastructure and people you run yourself. Your budget covers server nodes, MongoDB, the search backend and admin time to operate them. Confirm these items:
- Whether you will run Graylog Data Node or self-managed OpenSearch as the search backend. Graylog recommends Data Node.
- Storage sized from daily ingest, retention days and the 120 percent planning factor in the system architecture guidance.
- Node count for high availability. The multi-node guide describes three Graylog and MongoDB nodes plus three Data Nodes for medium to large deployments.
- Who handles upgrades and patching, since community support is the only support included.
- Which identity features you need. Open supports Active Directory, LDAP and trusted header authentication.
Enterprise adds a subscription priced on processed data. Graylog's pricing page lists a starting point of 15,000 US dollars per year, with a minimum of 10 GB per day or 100 Graylog Compute Units. The fee sits on top of your infrastructure, so the cost change depends on what the add-on lets you avoid building. Confirm these items:
- How the quote maps to your daily volume and whether the 10 GB per day minimum or the Compute Unit minimum applies.
- Whether archive restore and data tiering reduce the hot storage you buy on Data Nodes.
- Whether the correlation engine and 24/7 support replace internal effort or tools you already pay for.
- That no per-user or per-device fees apply, as the pricing page states, and that the written quote reflects that.
- Whether Okta, OpenID Connect and SAML single sign-on, which are Enterprise features, change your identity work.
Graylog Security is priced on processed data with a starting point of 18,000 US dollars per year on the pricing page, and it carries the same volume minimum. It adds SIEM features such as risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content. This route also changes the search backend requirement. Confirm these items:
- That your search backend runs OpenSearch 2.0 or later, which Security requires. An existing OpenSearch 1.x cluster may need an upgrade first.
- Which SIEM features you will use in the first phase, so the subscription is not sized for modules nobody runs.
- Whether the compliance packs and threat content fit your framework and whether your team has time to tune them.
- Storage growth from enrichment and retained investigation data, measured against your daily ingest.
- Whether the security team or the platform team owns the subscription and the response workflow.
An upgrade from an older Graylog or from OpenSearch 1.x changes the backend cost even when the license stays the same. Graylog has deprecated OpenSearch 1.x since Graylog 7.0 and will remove it in Graylog 8.0, so the backend has to move. Confirm these items:
- The target Graylog 7.x release and the MongoDB and OpenSearch or Data Node versions it supports, checked against the compatibility matrix.
- Whether the search cluster moves to a supported OpenSearch version or to Data Node, and the one-time effort to rebuild index sets and reindex data.
- The rolling upgrade window across a multi-node cluster and the downtime the business will accept.
- Whether the Enterprise or Security features you want need a backend version you do not run today.
- Temporary hardware or cloud capacity needed to run old and new clusters during cutover, which is one-time cost to request in the quote.
In air-gapped or data center deployments, storage and staffing often carry more of the cost than the subscription does. Installation media, updates and license activation all need a plan inside the isolated network. Confirm these items:
- Storage purchased up front, sized from daily ingest, retention days and the 120 percent planning factor, with the message journal on SSDs at 3 to 5 times daily ingest.
- Whether your subscription terms and license activation work without outbound connectivity, and who delivers offline updates.
- Staffing for round-the-clock operations, or whether Enterprise 24/7 support covers the gap in your team.
- Hardware for the three Graylog and MongoDB nodes and the three Data Nodes, placed so a single failure does not stop ingestion.
- Mirrored package repositories and copies of MongoDB and search backend artifacts needed for patching.
What you need to provide for an accurate estimate
Missing volume data is the most common reason a Graylog estimate changes after signing, so start there. Provide measured daily ingest per source over at least one full business cycle, taken from the platforms that already ship logs. Graylog Enterprise and Security are licensed on processed data with a minimum of 10 GB per day or 100 Graylog Compute Units, so this figure largely decides the edition and the quote. Report average and peak volumes separately, and flag noisy sources such as firewalls or verbose debug logging, since filtering them before storage changes both license and storage needs.
Next, list retention by log type and the regulatory minimums that apply to each, and ask compliance to confirm them in writing. Graylog's architecture guidance sizes log storage from daily ingest, retention days and a 120 percent factor, so one retention figure for every source will misstate the Data Node or OpenSearch cluster. Also state your current storage and hosting platform, the MongoDB and OpenSearch versions in use, and whether a Data Node cluster is already planned. Graylog 7.0 to 7.2 support MongoDB 7.x up to 8.2.x, and OpenSearch 1.x use is deprecated and will be removed in Graylog 8.0, so existing versions can add migration work.
Then separate must-have features from nice-to-haves. Active Directory and LDAP authentication work in Graylog Open, while Okta, generic OpenID Connect and SAML single sign-on require Enterprise. Archive restore, data tiering, the correlation engine and SIEM content such as compliance packs and threat detection belong on the same list. Describe staffing and the on-call model, including who receives alerts through PagerDuty, Slack or email. Share procurement rules, such as vendor onboarding steps, purchase order thresholds and approval routes, and name one decision owner who can accept scope and edition choices. Without that person, estimates tend to stall in review.
Questions about Graylog cost and editions
Is Graylog Open free to run in our own infrastructure?
The license is free. Graylog's pricing page lists Graylog Open with no volume limits and community support. You still pay for the servers or cloud instances that run Graylog server nodes, MongoDB, and Data Node or self-managed OpenSearch for storage, plus network, backups, monitoring and the staff hours needed to operate it. Community support is the support level listed for Open, so decide early whether your team, a partner or a paid retainer will cover production issues. Confirm your own sizing before you assume a total.
How are Graylog Enterprise and Graylog Security priced?
Both are subscriptions licensed on processed data, with no per-user or per-device fees. Graylog's pricing page lists Enterprise starting at 15,000 US dollars per year and Security starting at 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units. Your quote depends on daily processed volume, the tier you choose and the minimum that applies to you. Ask Graylog to confirm current prices, how processed data and compute units are measured, and how volume growth is billed.
Can our team model Graylog storage costs alone, and how does retention change them?
Yes, if you have daily ingest per log source and a retention target for each log type. Graylog's system architecture guidance advises sizing log storage as daily ingest multiplied by retention days, then multiplied by 120 percent. Storage grows in direct proportion to retention, so a longer retention period raises disk and node counts in both Data Node and OpenSearch. Add space for the message journal at 3 to 5 times daily ingest on SSDs. Then add nodes, MongoDB, licensing and admin time.
How long does a Graylog cost review take, and what does it need from us?
No fixed duration applies to every review. The time depends on how many log sources you have and how quickly you can provide data about them. Sources without measured daily volume need a sample period or existing platform reports before estimates hold. Expect to provide a source list with daily ingest, retention needs by log type, expected growth, hosting constraints, current tooling costs and the team that will operate Graylog. Fixed-scope work has its timeline agreed in writing before it starts.
Does the SSPL-1.0 license affect our procurement or legal review?
Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0) from Graylog 4.0 onward, while earlier releases used GPL v3. SSPL-1.0 is not an OSI-approved open source license, so teams that assume open source terms may need a closer look. Procurement and legal teams usually check whether the license permits their planned use, including any plan to offer Graylog as a service to others. This is a description of the license, not legal advice. Ask your counsel to review the LICENSE text in the Graylog repository.
Does a Graylog cost review cover upgrades and ongoing support?
A cost review estimates the platform and its running costs. Upgrades and ongoing support are separate scopes that you agree in writing. Graylog 7.x minor releases, MongoDB and OpenSearch compatibility and the OpenSearch 1.x deprecation before Graylog 8.0 all create recurring work. Graylog Enterprise includes 24/7 support according to its pricing page, while Graylog Open has community support. DeployOpen offers ongoing support, upgrades and continuous testing as retainers, so ask for the upgrade path and retainer terms in the written scope.
How DeployOpen scopes and supports Graylog cost work
DeployOpen works through Graylog cost of ownership and editions as a written, fixed-scope engagement inside infrastructure you control. We size the edition, storage and admin workload against your own ingest and retention so the cost picture is specific to your environment.
How we scope
- We record daily log volume by source, retention periods by log type and the expected processed volume that Graylog licensing will be measured against.
- We compare Graylog Open with Enterprise and Security against the features your teams need, such as tiering, archive restore, SIEM content or single sign-on.
- We map Data Node or self-managed OpenSearch, MongoDB and server node counts to the chosen scale, and list which items are one-time and which recur.
- We confirm current pricing, minimums and compatibility directly with Graylog before the written scope is signed, since those terms can change.
How we build
- We deploy a sized reference environment for the chosen edition and check the cost assumptions against measured ingest and storage growth.
- We configure index sets, rotation and retention per log type so storage consumption matches the retention plan written in the scope.
- We test sizing with representative traffic and document the storage, compute and administration effort the team should expect each month.
- We verify compatibility between Graylog, MongoDB and the search backend for the release line in use before any production traffic is moved.
How we hand over
- You receive a cost model that lists licence, infrastructure, storage and staff effort components, with the drivers that move each one up or down.
- We provide runbooks for index retention changes, volume monitoring and the licence volume checks your finance and operations teams will repeat.
- Knowledge transfer sessions cover how to review processed volume, adjust retention and plan a future edition change without reworking the platform.
- Handover includes the list of open decisions, such as retention length or Enterprise features, that your leadership must confirm.
How we support
- Ongoing support, upgrades and monitoring are available as a retainer, which can cover re-running the cost model as ingest grows.
- Retainer work can include planning for the OpenSearch 1.x deprecation before Graylog 8.0 and for moves between Graylog minor releases.
- We can review quarterly processed volume and storage trends against the agreed cost model and flag when an edition review is due.
- Support scope, response expectations and fees are set out in the written agreement, and DeployOpen does not publish a price list.
