Self-host Graylog

Observability

deployed & timed by usprices checked · Jul 2026

Centralized log management on MongoDB and OpenSearch, with search, dashboards, and alerting for large-volume log ingestion.

Splunk / yr$1,800

Self-hosted / yr~$55

You keep$1,745/yr

Key facts

CategoryObservability

LicenseSSPL-1.0

StackJava, MongoDB, OpenSearch

Min RAM8192 MB

Dockeryes

Difficulty

Our recommendation

Choose Graylog when you're centralizing serious log volume — search, dashboards, and alerting across OpenSearch, with MongoDB for configuration — and you have a real ops team to run it. If your logs fit on one box and you don't need Graylog's specific search UI, OpenObserve or SigNoz is dramatically less to operate.

What you need

Any VPS with at least 8192 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About the better part of a day

Install with Docker Compose

Save this as compose.yml and run docker compose up -d:

# Graylog — official docker-compose stack (Graylog + MongoDB + OpenSearch)
git clone https://github.com/Graylog2/docker-compose && cd docker-compose
# set GRAYLOG_PASSWORD_SECRET (16+ chars) and GRAYLOG_ROOT_PASSWORD_SHA2 in docker-compose.yml
docker compose up -d  #  →  http://SERVER_IP:9000

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Graylog is the heaviest tool in this roster, and the licence is the first thing to get right:

non-negotiableIt's SSPL, not an OSI-approved open-source licence. Source-available with obligations if you offer it as a hosted service — confirm that's acceptable for your situation before you rely on it.

non-negotiableIt's an 8 GB stack minimum. OpenSearch and MongoDB are both real databases running alongside Graylog itself — this is cluster-grade hardware, not a spare VPS.

non-negotiableThree services to keep healthy. Graylog, MongoDB, and OpenSearch each need their own backup and upgrade discipline — a version mismatch between them is the most common way this stack breaks.