Skip to content

Self-host Graylog

updated Jul 2026prices checked · Aug 2026Install verified on Ubuntu 26.04 · Jul 2026 · how we test

Centralized log management on MongoDB and OpenSearch, with search, dashboards, and alerting for large-volume log ingestion.

Splunk / yr$1,800
Self-hosted / yr~$55
You keep$1,745/yr
Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera → (opens in new tab)

Key facts

CategoryObservability
LicenseSSPL-1.0
StackJava, MongoDB, OpenSearch
Min RAM8192 MB
Dockeryes
Difficulty
Our recommendation

Choose Graylog when you're centralizing serious log volume — search, dashboards, and alerting across OpenSearch, with MongoDB for configuration — and you have a real ops team to run it. If your logs fit on one box and you don't need Graylog's specific search UI, OpenObserve or SigNoz is dramatically less to operate.

What you need

  • Any VPS with at least 8192 MB of RAM
  • A domain you control — most self-hosted setups need HTTPS in front of them
  • About the better part of a day

Install

Run these commands on your server:

# Graylog — official docker-compose stack (Graylog + MongoDB + OpenSearch)
git clone https://github.com/Graylog2/docker-compose && cd docker-compose/open-core
# the compose files live in open-core/ (also: cluster/, enterprise/, forwarder/)
# the stack reads both secrets from a .env file, not from docker-compose.yml:
printf 'GRAYLOG_PASSWORD_SECRET=%s\nGRAYLOG_ROOT_PASSWORD_SHA2=%s\n' \
  "$(openssl rand -base64 32 | tr -d '\n')" \
  "$(printf changeme | sha256sum | cut -d' ' -f1)" > .env
# replace 'changeme' above with your own admin password before running
docker compose up -d  #  →  http://SERVER_IP:9000
vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Graylog is the heaviest tool in this roster, and the licence is the first thing to get right:

non-negotiableIt's SSPL, not an OSI-approved open-source licence. Source-available with obligations if you offer it as a hosted service — confirm that's acceptable for your situation before you rely on it.
non-negotiableIt's an 8 GB stack minimum. OpenSearch and MongoDB are both real databases running alongside Graylog itself — this is cluster-grade hardware, not a spare VPS.
non-negotiableThree services to keep healthy. Graylog, MongoDB, and OpenSearch each need their own backup and upgrade discipline — a version mismatch between them is the most common way this stack breaks.

An alternative to

Splunk →

More in Observability

Observability

Grafana

The standard open-source dashboarding and visualization layer for metrics, logs, and traces, querying Prometheus, Loki, and dozens of other data sources.
GoTypeScript
easyRead guide →
Observability

Netdata

Real-time, per-second monitoring of systems, containers, and applications with zero-configuration auto-detection and a lightweight C agent.
C
easyRead guide →
Observability

OpenObserve

A single Rust binary that ingests, indexes, and queries logs, metrics, traces, and frontend RUM events, with Parquet-based columnar storage for low storage cost.
Rust
easyRead guide →
Observability

Prometheus

The de facto open-source metrics time-series database and alerting engine, scraping targets over HTTP and powering most self-hosted dashboarding stacks.
Go
easyRead guide →

We use analytics cookies (Google Analytics, PostHog) to see which guides are useful. No ad networks, no cross-site tracking. See our privacy policy.