Lennart Koopmann did not set out to build a security company. In 2009, the German software engineer needed to make sense of machine logs and received a one-year license quote from the dominant vendor. The number was ridiculous enough to trigger a familiar engineer fantasy: I can build this myself in two weeks. The schedule was fantasy. The irritation was productive. Graylog grew from that refusal into a Houston-based company selling log management, SIEM and API security to organizations that have plenty of telemetry and too few people to babysit it.
The product sits where IT operations and security operations overlap. Servers, applications, cloud services, identity systems, firewalls and APIs all emit records of what they did. Graylog collects those records, normalizes them, routes them, stores them and makes them searchable. An SRE can trace a failing checkout across microservices. A compliance analyst can produce an audit report. A threat hunter can connect an odd login with a risky asset and a suspicious API call. The raw material is the same. The question changes.
The free product is the front door, not the souvenir
Graylog's sharpest piece of product design may be its pricing ladder. Graylog Open is free, self-managed and has no data-volume restriction. It includes collection, pipelines, streams, search, dashboards, basic alerts and API access. That is enough to solve real problems, which explains why the company's GitHub server repository has accumulated more than 8,000 stars and why the software keeps turning up in home labs and large infrastructure teams alike.
Collect, transform, search and visualize logs. The customer supplies the infrastructure, maintenance and engineering attention.
Advanced log management, compliance reporting, access controls, data routing, support and deployment help. Public pricing starts at $15,000 a year.
Adds SIEM work: correlation, threat content, risk scoring, anomaly detection, investigations and response workflows.
Records and analyzes API traffic to catch abuse that gateways and web application firewalls can miss.
The hidden price of free software is not a license. It is ownership. Someone must deploy it, tune indexes, plan storage, patch nodes and understand why messages are backing up. Graylog says Open is for teams with the engineering time to do exactly that. Enterprise begins at $15,000 annually for 10 GB per day or 100 annual consumption units. Bigger Security deployments are quoted. Cloud and hybrid options move more of the operational burden back to Graylog.
The published starting point for Graylog Enterprise. Open costs nothing in license fees, but a team still pays in compute, storage and engineer hours.
That commercial transition is not a betrayal of the free edition. It is the point of the model. A team can prove that centralized logging matters before procurement gets involved. The paid product arrives when downtime, audits and staff time become dearer than the subscription. Graylog gets a qualified customer; the customer buys after seeing its own logs answer its own questions.
What failed first at 750,000 messages a second
Kaizen Gaming offers the useful version of a customer story because something actually broke. The online betting company began using Graylog's open edition in 2012. By 2023, its cluster was processing enormous traffic across more than 600 microservices. During peaks, searches slowed, disruptions arrived weekly and logs could be lost during downtime. Collection had succeeded so thoroughly that operating the collector became the problem.
That changed the economic calculation. Kaizen moved to Enterprise at the end of 2023 and rebuilt the cluster with Graylog engineers. The migration began in non-production before touching production. The teams removed unnecessary replicas, adjusted shard sizes, tuned pipelines and stream rules, increased output batch sizes and changed processor settings. It was not a magic license-key moment. The paid relationship bought architecture work, support and a more capable operating model.
Kaizen later reported months without an outage and processing latency of two to three seconds, down from 20 to 30. It retains roughly 200 TB while ingesting 15 to 20 TB daily, with bursts as high as 750,000 messages per second. The copyable lesson is pleasantly unglamorous: measure the bottleneck, fix the data architecture, rehearse away from production and make the vendor transfer knowledge instead of merely dropping off software.
From finding errors to building the case
Graylog's expansion follows the work its customers were already doing. Enterprise turned search into a governed operational system. Graylog Security added correlation, threat intelligence, anomaly detection, risk scoring and investigation. The 2023 acquisition of Resurface.io supplied a purpose-built API flight recorder that can spot suspicious behavior from authenticated users, the sort of traffic a gateway may wave through because the credentials look valid.
The more recent work is about reducing clerical drag. Graylog 7.0 added explainable dashboard summaries, an MCP server for connecting a customer's chosen language model within Graylog's permissions, and selective access to Amazon Security Lake. Version 7.1, released in May 2026, can open an investigation automatically when an asset crosses a configured risk threshold, attach related alerts and evidence, and consolidate remediation steps before an analyst arrives.
This is a more credible use of AI than a chat box pasted over a security console. The task is narrow: summarize what is visible, collect related material and draft the paperwork. The analyst still decides whether the behavior is malicious and what happens next. For lean teams, saving ten minutes of evidence gathering on every serious alert can matter more than an impressive demo prompt.
Its market is the team between DIY and empire
Graylog competes with Splunk, Elastic Security, Microsoft Sentinel, IBM QRadar, Sumo Logic, Datadog and LogRhythm, plus assemble-it-yourself stacks built from OpenSearch or Wazuh. It is not the only platform promising lower cost or faster search. Its distinction is the combination: a capable free entry point, the same general operating experience across self-managed, hybrid and cloud deployments, and a paid SIEM designed for teams that do not have a 50-person, round-the-clock SOC.
Data economics sit at the center. Traditional volume pricing can persuade teams to discard logs before they know which evidence an investigation will need. Graylog's internal data lake and AWS integrations let customers keep colder material, preview it and retrieve a narrow slice for analysis. Its consumption units convert differently across products - one unit currently covers more Enterprise volume than Security volume - but the pitch is consistent: route data according to value instead of treating every byte as equally hot and equally expensive.
The company has financed that expansion with some restraint. An $18 million growth-equity round landed in 2021. In 2023, Graylog secured another $39 million, but only $9 million was equity; $30 million was a flexible debt facility. Management said the blend would limit dilution and bridge toward profitability. The same year, Graylog reported 67 percent growth in year-to-date new bookings and said Security represented more than half of new customers. Its valuation remains private.
The playbook - and the boundary
A buyer can copy Graylog's best idea without buying Graylog: start with questions, not retention. Which incidents must be reconstructed? Which audit controls need evidence? Which application failures cost revenue? Collect and normalize the logs that answer those questions. Route high-value signals to fast storage, keep colder evidence cheaply, and test retrieval before an emergency. Then assign a named owner. A log platform without an owner becomes a beautifully indexed junk drawer.
Where it works
A lean security, SRE or IT team has substantial machine data, wants deployment control, can name the questions it needs answered and values a path from self-managed experimentation to supported operations.
Where it does not
The organization expects software to replace security judgment, chooses self-managed Open without staff to run it, or only needs lightweight tracing. High scale also demands architecture discipline; the Kaizen story proves that Graylog does not suspend physics.
Graylog says more than 60,000 organizations in 180 countries use its products. Named users span Deutsche Telekom Pan-Net, software company PROS, Kaizen Gaming, healthcare nonprofit Kennedy Krieger Institute, security provider NetAssist and telecom company Circles. The variety makes sense. Logs are not an industry. They are the exhaust of every digital industry, useful only when someone can turn them back into a sequence of events.
That remains Graylog's durable proposition seventeen years after the angry quote: keep the evidence, make it searchable and help a small team get to an answer before the incident becomes a meeting about why nobody had an answer.
Keep exploring