Self-host Graylog
updated Sep 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Sep 2026 · how we test
We earn commissions when you shop through the links below. Full disclosure →
Centralized log management on MongoDB and OpenSearch, with search, dashboards, and alerting for large-volume log ingestion.
Splunk / yr$1,800
Self-hosted / yr~$283
You keep$1,517/yr
Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera → (opens in new tab)
Key facts
CategoryObservability
LicenseSSPL-1.0
StackJava, MongoDB, OpenSearch
Min RAM8192 MB
Official imageyes
Measured idle RAM2998 MB
Difficulty
Our recommendation
Choose Graylog when you're centralizing serious log volume — search, dashboards, and alerting across OpenSearch, with MongoDB for configuration — and you have a real ops team to run it. If your logs fit on one box and you don't need Graylog's specific search UI, OpenObserve or SigNoz is dramatically less to operate.
Follow the Graylog deploy guide →What you need
- Any VPS with at least 8192 MB of RAM
- A domain you control — most self-hosted setups need HTTPS in front of them
- About the better part of a day
Where to host itaffiliate disclosure
Hetzner Cloudrun it on
From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + USKamaterafree trial
From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + AsiaDigitalOceanalso works on
From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + AsiaPaid link — we earn a commission if you shop through it.
Install
Run these commands on your server:
# Graylog — official docker-compose stack (Graylog + MongoDB + OpenSearch)
git clone https://github.com/Graylog2/docker-compose && cd docker-compose/open-core
# the compose files live in open-core/ (also: cluster/, enterprise/, forwarder/)
# the stack reads both secrets from a .env file, not from docker-compose.yml:
printf 'GRAYLOG_PASSWORD_SECRET=%s\nGRAYLOG_ROOT_PASSWORD_SHA2=%s\n' \
"$(openssl rand -base64 32 | tr -d '\n')" \
"$(printf changeme | sha256sum | cut -d' ' -f1)" > .env
# replace 'changeme' above with your own admin password before running
docker compose up -d # → http://SERVER_IP:9000deploy guideHow to Deploy Graylog on a VPSvps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly
What you take on
Graylog is the heaviest tool in this roster, and the licence is the first thing to get right:
non-negotiableIt's SSPL, not an OSI-approved open-source licence. Source-available with obligations if you offer it as a hosted service — confirm that's acceptable for your situation before you rely on it.
non-negotiableIt's an 8 GB stack minimum. OpenSearch and MongoDB are both real databases running alongside Graylog itself — this is cluster-grade hardware, not a spare VPS.
non-negotiableThree services to keep healthy. Graylog, MongoDB, and OpenSearch each need their own backup and upgrade discipline — a version mismatch between them is the most common way this stack breaks.
An alternative to
More in Observability
Observability
Grafana
GoTypeScript
easyRead guide →
Observability
Netdata
C
easyRead guide →
Observability
OpenObserve
Rust
easyRead guide →
Observability
Prometheus
Go
easyRead guide →