Managed Graylog
Design My Graylog

Independent Graylog engineering deploy · operate · migrate

Your Logs. Your Infrastructure. Fully Managed.

Production-grade Graylog infrastructure deployed, secured and maintained on the cloud or servers you choose. Built around your ingestion rate, retention and availability requirements.

Design My Deployment Talk to an Engineer

Stack we work with

  • Graylog
  • Linux
  • Docker
  • Terraform
  • Ansible
  • AWS
  • Google Cloud
  • Hetzner
topology / prod-logging reference architecture

// the problem

Running Graylog shouldn't become another infrastructure problem.

Graylog is straightforward to install and easy to outgrow. Most of the environments we see did not fail because of Graylog — they failed because nobody designed the infrastructure around it.

events / platform-health crit warn info
  • CRIT topology.single_node Single-server deployments Graylog, search and MongoDB on one VM. When it goes down, so does your visibility.
  • WARN disk.watermark Disk growth Indices grow faster than planned until watermarks block writes.
  • WARN retention.default Poor retention planning Retention set by default, not by requirement — too short for audits, too long for disks.
  • CRIT input.not_running Failed inputs An input stops after a restart or certificate change. Nobody notices for days.
  • WARN collector.silent Broken collectors Agents silently stop shipping after OS or configuration changes.
  • CRIT search.heap_pressure Overloaded search nodes Oversized shards and heap pressure. Searches time out exactly when you need them.
  • WARN mongodb.unmaintained MongoDB issues No replica set, no authentication, several versions behind.
  • CRIT cluster.status_red Cluster failures A node drops, the cluster goes red, recovery becomes trial and error.
  • WARN version.eol Upgrades Stuck on an end-of-life version because the upgrade path looks risky.
  • WARN tls.cert_expiry TLS certificates An expired certificate breaks inputs and the web UI at the worst possible time.
  • WARN backup.untested Backups Backups exist. Nobody has ever restored one.
  • INFO alerting.none Alerting Nothing alerts when the alerting platform itself is unhealthy.
  • WARN journal.backlog High ingestion volume Traffic spikes fill the journal and processing falls behind.
  • INFO migration.pending Infrastructure migrations Moving a stateful platform to new infrastructure without losing logs.

We build the platform so you don't have to.

See what we do

// services

From a single server to a multi-node logging platform.

You choose the infrastructure. We engineer the platform — and keep it running if you want us to.

01

Graylog Deployment

From a single production server to multi-node clusters.

 02

Graylog Cluster Architecture

Resilient architectures for growing log volumes.

 03

Migration

Move existing Graylog environments with minimal disruption.

 04

Performance Tuning

Optimise ingestion, indexing, storage and search performance.

 05

Maintenance

Updates, health checks, configuration changes and troubleshooting.

 06

Security Hardening

TLS, access control, firewalling, secrets and secure architecture.

 07

Backup & Disaster Recovery

Backup and recovery designed around your retention requirements.

 08

Cloud Deployment

AWS, Google Cloud, Hetzner, Azure, OVHcloud and your own infrastructure.

 09

Infrastructure as Code

Terraform, Ansible and reproducible deployments.

 10

Monitoring

Health of infrastructure, storage, ingestion and critical services.

// engineering, not installation

We don't just install Graylog.

We design the infrastructure around it.

A reliable logging platform is ten layers deep. Graylog is one of them. Each layer has its own failure modes, and each one is part of what we deliver and maintain.

  1. 01

    Infrastructure

    Compute, network and disks sized from ingest rate and retention — not from a default VM template.

    • vCPU / RAM
    • NVMe / IOPS
    • private networks
  2. 02

    Operating System

    Hardened Linux, kernel and filesystem settings for search workloads, time sync, log rotation.

    • Debian / Ubuntu / RHEL
    • sysctl
    • chrony
  3. 03

    Graylog

    Nodes, inputs, streams, pipelines, index sets and alerting — configured for how your team investigates.

    • inputs
    • pipelines
    • index sets
  4. 04

    Data / Search

    Graylog Data Node or OpenSearch with shard, replica and heap strategy matched to your data.

    • data node
    • opensearch
    • shards
  5. 05

    Database

    MongoDB replica sets with authentication, TLS and a supported version path.

    • mongodb
    • rs0
    • auth
  6. 06

    Storage

    Hot data on fast disks, planned headroom below watermarks, growth modelled ahead of time.

    • watermarks
    • capacity model
  7. 07

    Security

    TLS on every hop that supports it, firewalls per tier, least-privilege roles, secrets outside repos.

    • tls
    • firewall
    • rbac
  8. 08

    Monitoring

    The platform watched as closely as the systems it collects from.

    • journal
    • throughput
    • cert expiry
  9. 09

    Backup

    MongoDB, configuration and search snapshots — with restores actually tested.

    • snapshots
    • restore drills
  10. 10

    Automation

    Terraform and Ansible so every environment can be rebuilt, reviewed and changed safely.

    • terraform
    • ansible
    • git

// infrastructure

Run it where it makes sense.

We can deploy into your existing infrastructure or provision a new environment around your requirements. The provider is a design decision: cost per TB, data location, network paths and what your team already operates.

Cloud & dedicated

Hetzner

Cost-efficient cloud servers and dedicated hardware in EU and US locations. A strong fit for high-volume, storage-heavy logging.

graylog-on-hetzner Public cloud

AWS

Run Graylog inside your AWS accounts, next to the workloads it collects from, with VPC-private components and S3-based backups.

graylog-on-aws Public cloud

Google Cloud

Graylog on Compute Engine with Persistent Disk or Hyperdisk, passthrough load balancing and Cloud Storage backups.

graylog-on-google-cloud Public cloud

Azure

Graylog on Azure VMs with Managed Disks, Azure Load Balancer and Blob Storage backups, integrated into your existing subscriptions.

graylog-on-azure
Cloud & bare metal

OVHcloud

Bare-metal and public cloud options in European and other regions, with private networking between servers.

Any Linux host

Other VPS & dedicated

Any provider that gives us modern Linux, predictable disks and private networking.

On-premises / colo

Your own servers

Bare metal or virtualised infrastructure in your data center, including restricted networks.

Provider names are used to describe where we can deploy. We are not an official partner of any provider listed.

// reference architecture

Every layer, accounted for.

A typical highly available Graylog platform. Hover or select a component to see what we design and configure at that layer.

GRAYLOG CLUSTER APPLICATIONS your workloads Linux journald · syslog Docker gelf driver Kubernetes daemonsets LOG COLLECTION agents · buffering · retries LOAD BALANCER / INPUTS tcp · udp · tls NODE 01 graylog NODE 02 graylog DATA LAYER data node · opensearch MONGODB metadata · rs0 STORAGE / BACKUPS snapshots · object storage

// use cases

Built for teams that depend on their logs.

Different workloads stress different parts of the platform: burst ingest, long retention, many sources, strict separation. The architecture follows the workload.

  • SaaS companies

    Application, API and infrastructure logs in one place, with streams per service and retention per data class.

  • E-commerce

    Checkout errors, payment gateway responses and traffic spikes visible while they are happening — not after the weekend.

  • Hosting providers

    High-volume syslog from hundreds of hosts, with isolation between customer environments designed in from the start.

  • Game servers

    Bursty ingest from game and matchmaking servers, with fast search when players report problems.

  • Kubernetes environments

    Container logs with pod, namespace and node metadata, collected by DaemonSets and routed by stream.

  • Linux infrastructure

    journald, syslog and auditd from fleets of Linux servers, parsed into fields you can actually search.

  • Web applications

    Nginx, Apache and application logs correlated by request, with alerting on error rates.

  • Security monitoring

    Authentication, firewall and audit logs retained and searchable for investigations. SIEM features depend on the Graylog edition.

  • Enterprise IT

    Windows event logs, network devices and business applications under one access-controlled platform.

  • MSPs & IT providers

    Per-client environments or carefully separated streams, operated consistently across your customer base.

// how it works

From first conversation to a platform you can rely on.

Seven steps, the same every time. You can stop after the design, after the deployment, or keep us on to operate it.

  1. step 01 · intake

    Tell us what you have

    Current setup, log sources, volumes, pain points. Rough numbers are fine.

  2. step 02 · assess

    We review your workload

    Ingest rate, message size, retention, search patterns and availability needs.

  3. step 03 · design

    We design the architecture

    Topology, sizing, provider, security model — written down with the reasoning.

  4. step 04 · provision

    We deploy the infrastructure

    Provisioned as code with Terraform and Ansible, reviewed with your team.

  5. step 05 · configure

    We configure Graylog

    Inputs, collectors, streams, pipelines, index sets, dashboards and alerts.

  6. step 06 · harden

    We secure and monitor it

    TLS, access control, firewalls, platform monitoring and backup verification.

  7. step 07 · operate

    We maintain it

    Patching, upgrades, capacity planning and troubleshooting — or a clean handover.

// infrastructure assessment

Request a deployment plan.

Tell us what you run and what you need. We use it to prepare a first architecture outline — not to put you into a sales funnel.

01 Contact
02 Current environment
03 Workload
04 Infrastructure & requirements

Preferred infrastructure

High availability required?

Monitoring required?

Backup required?

05 Anything else

Please do not include passwords, API keys, private keys or cloud credentials. We will agree a secure way to share access later.

An engineer reads every request. No automated sales sequence.

// pricing

Every environment is different.

A 10 GB/day single-node setup and a multi-terabyte HA cluster are different projects. Rather than publish numbers that fit nobody, we scope each environment and send a written quote.

Request a Quote

What pricing depends on

  • Infrastructure sizeNumber and size of hosts across all tiers.
  • Log volumeDaily ingest and peak rates drive compute and disk.
  • RetentionHow long data is kept and searchable.
  • Number of nodesGraylog, search and MongoDB members.
  • Cloud providerProvider-specific networking, storage and automation.
  • HA requirementsRedundancy, failure domains and failover testing.
  • Maintenance scopeUpgrades, patching and change volume.
  • MonitoringDepth of platform monitoring and alert routing.
  • BackupBackup scope, frequency and restore testing.
  • Support levelCoverage hours and response expectations.

Deployment

Fixed-scope project

Design and build of a new environment, delivered as code with documentation.

Migration

Fixed-scope project

Planned move to new infrastructure, versions or search backend, with cut-over and rollback.

Managed Infrastructure

Monthly

We operate the platform: monitoring, patching, upgrades, capacity and backups.

Maintenance

Monthly or hours-based

Health checks, upgrades and troubleshooting for environments you run yourselves.

Consulting

Time-boxed

Architecture reviews, sizing and edition evaluation with a written outcome.

Infrastructure costs are billed by your provider — ideally directly to your account. Commercial software licenses, if needed, are purchased from the vendor and are separate from our services.

// software & licensing

We provide engineering. Software licensing follows the vendor.

Software licensing depends on the Graylog edition and deployment model you choose. Graylog Open is free and source-available under the SSPL; Graylog Enterprise and Graylog Security are commercial editions licensed by Graylog, Inc. If you need commercial Graylog functionality, you obtain the appropriate license from the vendor and we deploy and operate it for you.

Need Graylog Enterprise or Security features? We can help you evaluate licensing and deployment options from a technical point of view. This is not legal advice — license terms are defined by each vendor.

Read our licensing notes

// faq

Questions engineers ask us.

Straight answers about deployment, operations, OpenSearch, Data Node and licensing.

All questions
What is Graylog?

Graylog is a centralized log management platform developed by Graylog, Inc. It receives logs from servers, applications, containers and network devices, processes them into structured fields, stores them in a search backend and lets you search, dashboard and alert on them. A Graylog deployment consists of the Graylog server, MongoDB for configuration and metadata, and a search backend — Graylog Data Node or OpenSearch in current versions.

What is Graylog Open?

Graylog Open is the free edition of Graylog. According to the vendor, it is source-available under the Server Side Public License (SSPL) and has no ingest volume cap. It covers core log collection, processing, search, dashboards and alerting. Commercial editions — currently Graylog Enterprise and Graylog Security — add further functionality under a paid license.

Are you affiliated with Graylog, Inc.?

No. managed-graylog.com is an independent infrastructure and consulting provider. We are not an official Graylog partner, reseller or managed service, and nothing on this site is endorsed by Graylog, Inc. Graylog is a trademark of its respective owner.

Can you deploy Graylog on Hetzner?

Yes — on Hetzner Cloud servers, Hetzner dedicated servers or a hybrid of both. Dedicated servers with local NVMe are often a cost-effective choice for the search tier. One design detail: Hetzner Cloud Load Balancers do not forward UDP, so UDP syslog needs a different ingestion design.

Can you build a high-availability Graylog cluster?

Yes. A typical HA design uses two or more Graylog nodes behind a load balancer, a search cluster of at least three nodes with replicas, and a three-member MongoDB replica set — spread across failure domains and tested by failing components before go-live.

Can you deploy Graylog Data Node?

Yes. Graylog Data Node is the vendor's component for running and managing the OpenSearch-based search layer, including certificate handling and version management. Graylog's documentation lists it as a preferred option for current versions. Whether Data Node or self-managed OpenSearch is the better fit depends on how much control you need over the search cluster.

Can you manage an existing Graylog cluster?

Yes. Takeovers start with read-only access and a written health check covering versions, disks, indices, journals, search cluster health, MongoDB, certificates, backups and access. Then we fix what is urgent and move the environment into ongoing maintenance if you want that.

Can you migrate my Graylog server?

Yes — to new hardware, a different provider, a newer Graylog version, or from Elasticsearch to OpenSearch or Data Node. Migrations are planned with a cut-over and rollback procedure, and where possible logs are dual-shipped during the transition.

Can you maintain the server after deployment?

Yes. Ongoing maintenance covers OS patching, Graylog and dependency upgrades, capacity management, backup verification and troubleshooting. Scope and response expectations are agreed per environment.

Do I need a Graylog commercial license?

It depends on the features you need and how you use the software. Graylog Open covers core log management. If your requirements include functionality from Graylog Enterprise or Graylog Security, you obtain a license from the vendor. We can map your technical requirements to editions, but we do not provide legal advice — license terms are defined by the vendor.

You have logs. We build and operate the infrastructure that makes them useful.

Tell us about your environment. An engineer will reply with a first architecture outline.

Design My Deployment [email protected]Email us