// infrastructure / aws

Graylog on AWS

If your workloads run on AWS, keeping log infrastructure in the same region avoids data transfer surprises and lets you use the IAM, VPC and backup tooling you already govern.

We deploy Graylog into your AWS account on EC2, typically across multiple Availability Zones within one region. Graylog nodes sit behind a Network Load Balancer, which supports both TCP and UDP listeners for syslog and GELF traffic.

Managed search services are tempting, but compatibility with Graylog depends on the Graylog version and the service's supported API surface. We verify against current Graylog documentation before recommending one. In most cases, Graylog Data Node or self-managed OpenSearch on EC2 is more predictable.

// reference build

How a Graylog environment on AWS is typically built

compute

Compute

EC2 instance families selected per role: memory for search nodes, balanced compute for Graylog nodes, burstable instances avoided for sustained ingest.

storage

Storage

EBS gp3 with IOPS and throughput provisioned independently of size — sized from real indexing load, not defaults.

networking

Networking

Private subnets, Security Groups per tier, VPC endpoints where they reduce NAT costs.

load balancing

Load balancing

Network Load Balancer for TCP/UDP inputs; Application Load Balancer or NLB with TLS for the web interface and API.

backups

Backups

Snapshots to S3 via the backend's S3 repository support where available, MongoDB backups to encrypted S3 buckets, lifecycle policies for retention.

automation

Automation

Terraform modules in your repository, Ansible or cloud-init for configuration, tags for cost allocation.

AWS is a trademark of its respective owner. We are an independent provider and not an official AWS partner. Provider capabilities change; we verify current features and pricing during design.

Planning Graylog on AWS?

Send us your ingest volume and retention requirements and we will outline a topology and sizing for AWS.