The Lens

Graylog centralizes all your logs in one place so you can search, dashboard, and alert on them, instead of SSHing around to grep across servers. It ingests logs from anywhere (syslog, GELF, Beats, Kafka), indexes them in OpenSearch, and gives you a web UI to search and build alerts. The open edition is free to self-host, though it ships under SSPL, which is source-available rather than truly open source.

Running it is heavy. Graylog itself is one piece; it also needs an OpenSearch (or Elasticsearch) cluster and MongoDB alongside it. That's three stateful systems to deploy, scale, tune, and back up. Budget real ops time, this is not a single container you set and forget.

The free Open tier handles ingestion, search, dashboards, and alerting, which is enough for a lot of teams. The paid Enterprise and Security tiers add archiving and data tiering, compliance reports, SSO, correlation, and SIEM features, priced for companies (think five figures a year). Solo and small teams: Open is genuinely capable. Larger or regulated teams: the paid tiers, or a hosted option, start to make sense.

This replaces Splunk for log management at a fraction of the cost, and covers the logs piece of Datadog or New Relic. The catch is the operational weight of OpenSearch plus MongoDB, and that SSPL doesn't give you the freedoms of a real open source license.