Graylog Enterprise features: what Open leaves out and when the license is worth it
If your team runs Graylog Open and keeps hitting limits in investigation, retention or access control, the question is not whether Enterprise is better software. Enterprise adds operational capabilities on top of the SSPL-1.0 Graylog Open codebase, and it is worth buying when those capabilities replace manual work or a second tool you would otherwise have to run, staff and secure. Start by listing the specific pain points: searches that analysts rebuild by hand, cross-source detections handled in spreadsheets, old data you must keep but cannot search cheaply, or single sign-on that your identity provider requires. Each item maps to a named Enterprise capability, and each capability either removes work or it does not.
The pricing basis matters for that calculation. Graylog's pricing page lists Graylog Enterprise from 15,000 US dollars per year, licensed on processed data with a minimum of 10 GB per day or 100 Graylog Compute Units, and with no per-user or per-device fees. Ask the vendor to show how your daily volume and any Compute Unit commitment translate into the annual figure, and whether the minimum applies to your environment. Enterprise is a separate license from Graylog Security, which is priced at a different level and adds SIEM features such as risk scoring and compliance packs. Do not assume that buying Enterprise gives you the Security feature set, or the reverse. Confirm which edition covers each capability you need before you budget.
Which Enterprise capability fits which operational problem
This table maps each Graylog Enterprise capability named in the product documentation to the operational problem it addresses, what Graylog Open provides in its place, and the signal that a team has outgrown the open edition. Read each row against your current workload, and confirm licensing for any feature with Graylog before you budget. Most Enterprise purchases follow a specific operational pain, so start from the signal and work back to the feature.
| Capability | Operational problem | What Graylog Open offers instead | Signal you need it |
|---|---|---|---|
| Archiving | Keep log data available beyond normal index retention | Index rotation and retention, which deletes the oldest indices | Retention rules require data kept longer than your indices hold |
| Correlation engine | Detect incidents that span several log sources | Event definitions on real-time and historical searches | Detections need sequences across sources, such as a login after an IDS alert |
| Search and dashboard parameters, search filters | Reuse one search or dashboard with different values per team or host | Separate searches and dashboards built for each set of values | Analysts copy the same query and edit values by hand each time |
| Reporting | Produce recurring summaries for management or auditors | Dashboards and manual exports; confirm any scheduled reporting on Open | Recurring evidence packs are assembled by hand each cycle |
| Enterprise inputs | Ingest sources beyond the standard input types | Syslog, GELF and Beats inputs documented for Graylog Open | A required source has no Open input in your environment |
| Illuminate | Parse and normalize many vendor log formats quickly | Custom processing pipelines and lookup tables written by your team | The parsing backlog grows faster than your team can write rules |
| Outputs and enterprise notifications | Send processed data or alerts to more destinations | Event notifications to PagerDuty, Slack and email | You need destinations or notification channels beyond those three |
| Teams management | Give each team scoped ownership of its searches and alerts | User accounts with Active Directory, LDAP or trusted header authentication | Several teams need separate ownership and Okta, OpenID Connect or SAML sign-on |
| Forwarder and user audit logs | Forward from managed collectors and trace configuration changes | Confirm forwarding and audit options for your Open version | Auditors ask who changed what, or collectors need central management |
What Graylog Open covers on its own
Graylog Open covers the core log pipeline without a license fee. Its inputs accept syslog, GELF and Beats, messages pass through streams and processing pipelines, and teams search and build dashboards on what arrives. Storage is managed through index rotation by message count, size or time, with retention that deletes the oldest indices. Event definitions can notify PagerDuty, Slack and email. For many teams, that is enough to centralize logs, run daily searches and alert on known conditions, so the first decision is whether your use cases stop short of the items below. Confirm which inputs you need, since some inputs are documented as requiring an Enterprise license, and check the current scope on the Graylog Open product page.
Two terms matter before you plan around Open. It is licensed under the Server Side Public License version 1 (SSPL-1.0), which is not an OSI-approved open source license, so legal and procurement teams should review it against their open source policy rather than assume it qualifies. Open also supports Active Directory, LDAP and trusted header authentication. Okta, generic OpenID Connect and SAML single sign-on are Enterprise features, so if your identity provider standard is one of those, confirm the licensing cost before designing the login model. Ask your identity team which protocol your directory and applications use today.
The gap to plan for is operational rather than functional. Open does not include the Enterprise correlation engine, archiving with archive restore, data tiering, reporting, or the Forwarder and user audit logs, so the question is whether your team needs multi-source detection, long-term retrieval or audit evidence. Those needs should be written down as requirements, with owners and retention periods, before you compare editions. Any quote should separate the Open build from the license scope, because the Enterprise and Security licenses are priced on processed data with a documented minimum of 10 GB per day or 100 Graylog Compute Units.
Which teams should buy Enterprise and which should stay on Open
Graylog Open covers ingestion, search, dashboards and event definitions without a license fee. The cases below show where an Enterprise capability changes daily work enough to justify its cost, and what to verify before signing. Each case depends on your sources, retention rules and identity model, so confirm the edition each feature needs against your own environment.
Multi-source correlation
Teams that need to link events from different log sources, such as a firewall alert followed by a successful login from the same address, are the clearest case for the Enterprise correlation engine. Event definitions on Open work on one stream at a time, so cross-source sequences otherwise need manual searching. Check how many sources must be joined, the time window your analysts expect, and whether the rule volume justifies the license. Ask your Graylog contact to confirm which correlation features ship with your tier.
Long-term archive restore
Organizations that must search old logs on demand, for audits or incident reviews, gain the most from Enterprise archiving and the data lake with archive restore. On Open, retention deletes the oldest indices, so anything not kept elsewhere is gone. Before buying, map which log types need months or years of searchable history, how often restores happen, and how long a restore may take. Confirm restore behavior and storage placement with Graylog before you size the cluster.
Reusable parameterized dashboards
Teams that run the same investigation across hosts, customers or regions benefit from Enterprise search and dashboard parameters, which let one dashboard prompt for a value such as a hostname or tenant. Open users can build the same searches, but they must copy and edit each one. Check how many dashboards need this pattern, whether lookup-based dropdowns are required, and who maintains the parameter values. Confirm the license needed for each parameter type before you plan the rollout.
SSO through SAML or OIDC
Enterprises that require one sign-on across Graylog and their identity provider need Enterprise single sign-on, which adds Okta, generic OpenID Connect and SAML. Graylog Open supports Active Directory, LDAP and trusted header authentication, which may suffice if your directory already serves those users. Check your identity provider, group mapping needs, and whether break-glass local accounts must remain available. Confirm the supported providers for your version in the authentication documentation.
Audit trails for access review
Teams that must show who viewed or changed Graylog configuration and data during periodic access reviews should evaluate Enterprise user audit logs. Open gives you roles and logs of its own, but reviewers often need a single record of user actions they can export. Check what the review requires, whether the audit log retention meets your policy, and where the records will be stored and protected. Ask Graylog which events are captured at your tier before relying on them as evidence.
Small teams with low volume
Small teams with modest log volume and a single identity source often run Graylog Open well without a license. Enterprise pricing starts at a minimum of 10 GB per day or 100 Graylog Compute Units, so low-volume deployments may pay for features they do not use. Check your daily ingest, the number of analysts, and whether any Enterprise feature is needed this year. Revisit the decision when volume, sources or compliance duties grow, since the license is priced on processed data.
How to evaluate Enterprise features before purchase
This sequence turns a vague wish for more Graylog features into a documented buy or do-not-buy decision that names the edition, the license scope and the test evidence behind it.
Inventory the manual workarounds today
The operations lead and the people who run daily investigations list every task they do by hand in Graylog or around it, such as copying searches between teams, exporting old messages to files, building alerts through spreadsheets or re-running the same triage queries each shift. Record how often each task happens, who performs it and what it costs the team in time and risk. The step is done when every workaround has a name, an owner and a short written description, and the list is reviewed by the security lead before anyone looks at pricing.
Map each workaround to a capability
For each workaround, the Graylog administrator checks the Graylog Enterprise feature list in the product documentation and names the capability that would replace it, such as archiving for long-term retention, the correlation engine for multi-source detection, search parameters for reusable searches, reporting, enterprise inputs, outputs, the Forwarder or user audit logs. Some tasks may map to nothing, and Graylog Open features such as streams, pipelines, dashboards and event definitions may already cover them. The check is a table where every row lists either one Enterprise capability or a note that Graylog Open already handles the task.
Confirm edition and data volume
The buyer reads the Graylog pricing page to confirm which edition contains each mapped capability and the stated minimum volume of 10 GB per day or 100 Graylog Compute Units. They then measure their actual daily ingest and retention needs, since licensing is based on processed data with no per-user or per-device fees. Ask the vendor for a written quote that lists the edition, the volume basis, the term, what is included in support and what recurs each year. The check is a quote that matches the mapped capability list line by line.
Test on a non-production node
The platform engineer installs the target Graylog version on a non-production cluster that mirrors the production Data Node and MongoDB layout as closely as practical, then applies the candidate feature with representative log samples. The test should exercise the real workflow, such as a correlation rule across two sources or a parameterized dashboard shared with an analyst, and record messages processed, errors and who could access what. Keep the test data anonymized where the data classification requires it. The check is a written test result that shows the feature working end to end with the expected volume.
Verify license activation and feature availability
After the license is issued, the administrator activates it on the non-production system and confirms in the running version that each mapped feature appears and works, rather than trusting the purchase record. Check the version against the current documentation and the compatibility matrix, because feature availability and supported backends depend on the release. Confirm that the license is applied on the production nodes too, not only the test environment. The check is a screenshot or export from the running system listing each licensed feature, dated and signed by the administrator.
Document the decision and its scope
The security lead and the budget owner write a short decision record that lists each capability, the edition and volume quoted, the test evidence, the features that Graylog Open covers instead, and the conditions that would trigger a review, such as a volume increase or a new compliance duty. Note who renews the license and who maintains the configuration. The record is complete when the approvers have signed it and it is stored with the platform documentation, so the next person can see why each Enterprise feature was bought or declined.
Authentication and access features by edition
Graylog Open supports Active Directory and LDAP authentication, along with trusted header authentication. With directory-backed sign-in, user identity and group membership live in your directory, so Graylog access follows the same accounts your staff already use. Trusted header authentication passes identity from a reverse proxy or gateway that has already authenticated the user, which only works if the header cannot be spoofed by clients that reach Graylog directly.
- Directory binding: Graylog reads user and group data from Active Directory or LDAP at sign-in, so disabling an account in the directory blocks new sessions.
- Group mapping: Access depends on how groups map to Graylog roles, so review those mappings during every access review.
- Trusted headers: The proxy must strip client-supplied identity headers and sit in front of every path to Graylog.
- Local accounts: Confirm which local administrator accounts exist outside the directory and who holds their credentials.
- Session behavior: Confirm how long existing sessions remain valid after an account is disabled.
Before relying on Graylog Open for offboarding, confirm with your directory team that disabling an account removes Graylog access in practice, and test it with a non-production user.
Graylog Enterprise adds Okta, generic OpenID Connect and SAML single sign-on. These options move sign-in to your identity provider, so the provider's policies for multi-factor authentication, session lifetime and account disablement apply to Graylog. This is usually the stronger model for organizations that already run a central identity provider, because one disablement event covers many applications, though it adds a dependency on that provider being available.
- Okta: Use the Okta option when your identity provider is Okta and you want its native configuration.
- OpenID Connect: The generic option covers providers that follow the OIDC standard, which depends on the claims your provider sends.
- SAML: Use SAML where your provider or federation service issues SAML assertions and attribute mappings are agreed.
- Role mapping: Confirm which claims or attributes control Graylog roles, since a missing claim can leave users with too little or too much access.
- Fallback access: Decide how administrators sign in if the identity provider is unavailable.
Confirm with the identity team which claims or attributes will carry group data, who owns the application registration, and how the provider handles deprovisioning.
Teams management and user audit logs are Enterprise capabilities listed among the features of Graylog Enterprise. Teams group users and grant them access to specific streams, dashboards and searches, which keeps permissions tied to work rather than to individual accounts. Audit logs record user activity, which gives reviewers evidence of who did what, provided the records are retained and reviewed.
- Team scoping: Teams let you limit access to the data each group needs, which shortens review work when people change roles.
- Access reviews: Export the membership of each team on a fixed schedule and have a data owner approve it.
- Audit trail: Confirm which user actions are logged and where those records are stored, because the audit log is only useful if it survives an incident.
- Retention of audit records: Set how long audit records are kept, and protect them from edits by administrators who also manage Graylog.
- Offboarding: Removing a user from the identity provider or directory should be paired with a check that team memberships and local accounts are also closed.
Ask the vendor which audit events are recorded in your version and whether they can be forwarded to a separate log store.
Access reviews and offboarding work the same way across editions: the question is always whether an account that should be gone can still reach Graylog, and whether anyone can see that it did. Graylog Open with directory authentication relies on the directory to end access, while Enterprise SSO relies on the identity provider. In both cases, Graylog's own administrator accounts and API tokens are a separate path that must be checked on its own.
- Account disablement: Test that disabling a user in the source system ends new sign-ins and existing sessions within a window your security policy accepts.
- API tokens: Inventory tokens created by users or service accounts, and revoke those tied to departing staff.
- Local administrators: Keep the list short, document the owners and review it with the same cadence as directory groups.
- Evidence: Keep the review output, approvals and offboarding tickets together so auditors can trace each decision.
- Role drift: Compare Graylog roles against job functions each quarter, since mapping rules tend to accumulate exceptions over time.
Run one offboarding test per edition before go-live, and record the result as evidence for your access review.
Security and operational considerations for Enterprise features
Enterprise features change who administers Graylog, where its data sits and which systems must be patched. The cards below cover the decisions that follow a license purchase, so they can be settled before rollout rather than after an audit or an incident.
License administration and ownership
Enterprise and Security licenses are applied to the Graylog deployment and priced on processed data, with a minimum of 10 GB per day or 100 Graylog Compute Units. Decide who in your organization can request, renew and change the license, and who receives vendor notices. Confirm the licensed daily volume against your actual ingest, since a license sized for last year's traffic can become the constraint. Ask who holds the license before the first renewal date arrives.
Audit log retention and destination
User audit logs are an Enterprise feature, so the audit trail for administrative actions exists only where that license is in place. Decide how long audit records must be kept, and whether they should stay in the same index sets as application logs or go to a separate, access-restricted stream. Confirm that audit events cannot be altered by the same administrators whose actions they record, and test that a search for a known change returns the expected entry.
SSO setup and break-glass access
Graylog Enterprise adds Okta, generic OpenID Connect and SAML single sign-on, while Graylog Open supports Active Directory, LDAP and trusted header authentication. Once SSO is the only login path, an identity provider outage can lock out every administrator. Keep a documented local break-glass administrator, store its credentials in a sealed vault with access logging, and test the login path before cutover. Review that account's use on a fixed schedule.
Archive storage location and residency
Archiving and archive restore are Enterprise capabilities that move older log data out of active search storage. The location of that archive determines which jurisdiction, backup regime and access controls apply to retained logs, which matters for regulated data. Ask where archives are written, who can restore them, how restore requests are approved, and whether restored data is returned to the same access boundaries as live data. Confirm these answers with your legal and records team before enabling archiving.
Forwarder placement and credentials
The Forwarder is an Enterprise component that collects and ships logs from hosts or sites into Graylog. Each Forwarder instance holds credentials that can send data into your cluster, so treat them like service accounts. Place Forwarders in the network zone closest to their sources, give each one its own credential, and rotate that credential when a host is retired. Confirm the Forwarder's network path and firewall rules with your security team before deployment.
Patching MongoDB and the search backend
Graylog stores configuration and metadata in MongoDB and log data in Graylog Data Node or self-managed OpenSearch. Compatibility depends on the Graylog version: Graylog 7.0 to 7.2 need MongoDB 7.x up to 8.2.x, and OpenSearch 1.x use is deprecated since Graylog 7.0 and removed in Graylog 8.0. Schedule patching for MongoDB and the search backend as part of the same change window as Graylog upgrades, check the compatibility matrix first, and keep a tested backup of both before each step.
Questions buyers ask about Graylog Enterprise
How much does Graylog Enterprise cost compared with Graylog Open?
Graylog Open is free with no volume limits and community support. According to the Graylog pricing page, Graylog Enterprise starts at 15,000 US dollars per year, with a minimum of 10 GB per day or 100 Graylog Compute Units, and it is licensed on processed data with no per-user or per-device fees. Graylog Security starts at 18,000 US dollars per year under the same volume basis. The license fee is only one line. Your quote from DeployOpen depends on the written scope: how many inputs need Enterprise features, how much data you process, how many teams use parameters or reporting, and whether you need archive restore. Ask the vendor to confirm current figures and whether your daily volume or Compute Units count applies to you.
How long does it take to adopt Enterprise features?
The timeline depends on which features you adopt and how much of your current Open setup they touch. Enabling a license is quick, but the work sits in the design: deciding which streams send data to archives, which event logic moves to the correlation engine, which dashboards need parameters, and who receives reports. Each of these needs testing against real log volumes and access rules. Archiving and data tiering also depend on storage sizing and retention decisions made earlier in the project. A fixed-scope agreement sets the timeline in writing before work starts, so ask for a phased plan that lists each feature, its prerequisites and its acceptance test.
What does the work require from our team?
Expect to supply people who know your log sources, your retention obligations and your incident response process. A platform engineer needs access to the Graylog servers, MongoDB, the Data Node or OpenSearch cluster and the load balancer. A security or operations lead needs to define which detections, reports and archives matter and who approves changes. Identity and access owners must confirm how single sign-on maps to Graylog roles. Plan time for these people during the engagement, because most delays come from waiting on decisions about scope, data ownership or access, not from the configuration itself.
Can our own team turn on Enterprise features without outside help?
Your team can enable many Enterprise features once the license is applied, because the administration interface exposes them. The harder part is designing them safely. Correlation rules, parameter defaults, output destinations and archive restore can each change what data is stored, who sees it and what alerts fire. Without a tested plan, a team can create noisy alerts, send sensitive data to the wrong destination or leave archives unrestorable. Decide which features your team will own, document the change process and agree on a review step before anything reaches production.
Do we need Graylog Security instead of Graylog Enterprise?
Choose Graylog Security if your main need is SIEM capability such as risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content, according to the Graylog pricing and product pages. Choose Graylog Enterprise if you need the data lake with archive restore, data tiering, the correlation engine and 24/7 support, but not the SIEM content. Graylog Security also requires OpenSearch 2.0 or later, so check your backend version before you buy. Ask the vendor to map each feature you need to an edition in writing, because the two editions overlap in some areas and differ in others.
What happens to our configuration if we downgrade from Enterprise to Open?
Confirm the downgrade behavior with Graylog before you rely on it. Your streams, pipelines, event definitions and dashboards are stored in the Graylog configuration and MongoDB, so they usually remain, but features that depend on the Enterprise license may stop working or become unavailable for editing. Archived data may need a path to remain accessible under a different plan, and correlation or parameter setups may need rework to run on Open. Before any downgrade, export your configuration, record which features each team relies on, and test the Open setup in a non-production environment. Ask DeployOpen to include this export and rollback check in the written scope.
How DeployOpen scopes Graylog Enterprise work
DeployOpen plans, implements, integrates, documents and supports self-hosted open-source platforms inside your own infrastructure, including Graylog. For Enterprise features, we start by confirming which capabilities your operations actually need and which Graylog Open already covers, so the license decision rests on your workflow rather than on the feature list.
How we scope
- Map each team's investigation and alerting workflow to the Enterprise capabilities it would use, and to what Graylog Open covers on its own.
- Confirm the license tier, data volume basis and OpenSearch or Data Node backend with your vendor before the written scope is agreed.
- Agree the written scope, deliverables and timeline in writing before work starts, since most engagements are fixed-scope.
How we build
- Configure the chosen Enterprise features in a non-production environment, such as archiving, parameters, outputs or enterprise inputs, against sample data from your sources.
- Test each feature against the searches, alerts and reports your analysts depend on, and record the expected results.
- Build access rules for teams and audit logging so that who can see and change what is documented and checked.
How we hand over
- Deliver written documentation of the configured features, the reasoning behind each license decision and the known limits to confirm.
- Walk your operators through daily tasks such as running searches, managing parameters, reviewing reports and checking archives.
- Leave a list of items to re-check at each Graylog upgrade, since feature availability and licensing can change between releases.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, so your team does not have to carry Graylog changes alone.
- Review new license terms, feature changes and upgrade notes with you before each planned upgrade is scheduled.
- Ask your vendor for current pricing and support terms, since DeployOpen does not publish a price list and quotes follow from the written scope.
