Has many features that you would normally not find in other other free Event Management software (which we tried many). It allows us to add the type of events we want to gather and can modify these events via Pipelines before they get stored (very useful for IIS logs). The website based interface is clean and easy to navigate which allows anywhere access. Both a good and bad feature is it does not provide any default alerts, conditions or dashboard content so you have to create them all from scratch, which can be time consuming. However, this does mean you don't get confused when you get an alert for something you have no idea what it means or is irrelevant to your environment. Searching events has become a lot more easier. Review collected by and hosted on G2.com.

You can setup email alerts for when a certain condition occurs, however there is a lack of complexity in the conditions. It can only be on total number of messages in a 'stream' or 1 field content is a certain value or 1 field over several messages add up to a certain value; there are no options to combine these conditions.

Additionally, we had trouble getting it to install and setup the correct back-end configuration for our environment. Reading the official documentation carefully is a must but we still ran into issues which we could not solve except via a complete rebuild.

This software is purely Event Management and does not do any Security incident management that paid-for SIEM software may do and so is not a full SIEM solution. Review collected by and hosted on G2.com.

Best performance, user friendly interface, very smart charts, lot of functionnality, cross-platform compatibility, data very speed searching, very clear indices management, easy to configure dashboard, a very clear and easy message setup and streaming configuration, graylog server configuration is not complicated. Review collected by and hosted on G2.com.

A little complicated for first installation and configuration, custom regular expression (grok, regex) is a little bit complex to configure. ElasticSearch configuration is more hard that expected, some minor bugs is detected during the first deployment. Review collected by and hosted on G2.com.

It's designed from the ground up to be scale able, user friendly, and snappy. It is a full featured product that we keep expanding our use of. From network infrastructure to Windows and IIS servers, sending our logs to Graylog has helped us identify problems. Review collected by and hosted on G2.com.

The learning curve is a little steep, but once you get the hang of it, it's easy to keep going and get your problems solved. Review collected by and hosted on G2.com.

Graylog was easy to setup and can be up and running in a matter of an hour. The GUI is easy to navigate and making changes to the config file is fairly simple. There is also good documentation. Review collected by and hosted on G2.com.

I have noticed that some of the operations seem to take longer in Graylog compared to the ELK stack. This is something to weigh when it comes to using this. The ease of setup may be good for a start, however if you want to display more complex graphs and visuals switching to ELK stack may be better. Review collected by and hosted on G2.com.

I like the security in the product and the peace of mind that I’ll get the results I need. Review collected by and hosted on G2.com.

Integration process and setup takes a bit to get going. Review collected by and hosted on G2.com.

The product flexibility, when you have some machine data somewhere and you want to get it, manipulate it and analyze it. The possibility to start free and then switch, when needed, to the enterprise solution Review collected by and hosted on G2.com.

It would be good to have more options to manipulate and present the data without the need of external solutions Review collected by and hosted on G2.com.

You can start with a single server, and migrate to a multi-server, highly available logging monster. Because there is no restriction on licensing for the base Graylog product, you can setup a test deployment and test what will happen when you upgrade etc in production.

The community is helpful and active. The product is getting updates frequently.

The system has a purpose built Graylog Collector client which you can monitor directly through the Graylog web interface to determine if the system is still sending logs properly.

Easily integrates with Active Directory to allow authentication of users. Also has the ability to integrate with AD Groups for providing easy access to new users.

All of the Graylog web interface is using the Graylog API. The API browser is well thought out and fully documented. Development teams should find it easy to navigate the API in order to integrate with Graylog. API access also means that any system used for monitoring that can make API calls will be able to query Graylog for system health statistics easily.

Overall the system is very well thought through and comprehensive. Review collected by and hosted on G2.com.

Documentation needs improvement. The marketplace is a bit hit or miss as far as the quality of the plugins.

Customer submitted marketplace items are not curated. Anyone who wants to put together a plug-in can, and while that's great it leads to a highly fragmented experience.

Graylog still relies on Elasticsearch 5.6.x which means that a large amount of the new Elasticsearch improvements are not yet supported.

The Collector Sidecar can and will stop sending logs at random, on Windows, or not startup during system startup after a reboot. Having a system that either forces the service to start or automatically restarts the service at a set period is ideal. Review collected by and hosted on G2.com.

- Easy to try out thanks for the OVA/docker

- Interface updates in real-time

- Good looking dashboards

- Integrates into various platforms like Slack for alerting

- Has API Review collected by and hosted on G2.com.

- Some aspects such as pipelines and collector snippets can have a bit of a learning curve

- Initial configuration of streams and alerts can take a long time. This can be setup using the API if you have time to look into that. Review collected by and hosted on G2.com.

I like graylog ability to ingest data from variety of sources, run analytics, and extremely fast searches. Review collected by and hosted on G2.com.

Well, not really dislike, but I would be happy if graylog introduce more dashboard graphs something like kibana, rules simulation engine to test the rules, how to use rules with real examples (documentation), ability to run search queries based on Boolean logic between 2 different documents [correlation] for example show data from all the events where logon id matches (something like vlookup/slookup but enhanced), ability to download automatic correlation rules something like alienvault ossim. Review collected by and hosted on G2.com.

Speedy Searches and Normalized Logs. The interface is easy to use and bery intuitive. The Indices are Flexibles. Review collected by and hosted on G2.com.

Archiving feature is limited and lack of a better integration to Cloud Storages like Azure Blob and GCP. in addition do Amazon S3. Review collected by and hosted on G2.com.