Graylog Erfahrungen

- Graylog is very powerful log, i have search around 50million of record in 3second only, very powerful log because it integrated with elastic search that perform log search very fast.
- Telegram alert notification is what i like, i create the rule to let it send notification to telegram so i know what is going on on the network/server log.
- enterprise license are free for one year, and make sure your traffic log not hit to 5GB/day.
- support various log protocol, nxlog from windows, syslog from linux, and other such as aws. but i use only nxlog and syslog only.

its perfect already but the dashboard not so nice, not so flexible on the reporting yet.

Very low cost of ownership, particularly if you can get the Community (Free, Open-Source) version to meet your needs. I’ve implemented Graylog at multiple organizations for only the cost of hardware / storage.

Would love to have more plugins / content packs available in the Graylog Marketplace. With limited hands on a team for a smaller company, there’s often not enough time to write extractors and content packs.

Graylog has alot of flexibility and a mature feature set. We use it across all of our Windows as well as Linux servers. It has a strong community and alot of flexibility, does not impose restrictions on our applications, good documentation and generally receives regular updates and features.

I find some of the latest changes to the GUI (changes happen all the time with Graylog) are less user friendly - functionality to get count tables are still there but it is less dummy proof whereas before a novice user could click around in the side navigation and discover certain features. There are also less cloud offerings for Graylog so it fits more the on-premise model where you manage the graylog server/infrastructure.

Graylog is a fantastic tool to summarize and aggregate data into simple and highly accessible visual depictions and dashboards. Although it is an open source log management solution, it is really flexible and agile, and helps me parse data rapidly and intuitively. I think it's one of the best alternatives to Splunk - and probably is a much better tool even for enterprises.

Learning curve is a little bit steep. You need a somewhat technical background to learn it, but once you grasp the basics, it is way less cumbersome than others such as Alienvault or Loggly.

Graylog can be totally free, and you can collect logs from windows and linux systems and from other devices such as firewalls and switches (there are many more).
You need a linux machine to install and run graylog server. With Windows and Linux you have to install Sidecar and Filebeat to collect data and configure the agent.
You can create many indices and set their retention policies.
Once you start collecting logs you can do searches with lucene query, and save your queries. Then you can download the results in .csv format.
With Graylog you can create dashboards, set alerts (e.g. via email or via telegram) that help to keep your network safe, remember to set the right path of logs in your Winlogbeat and Filebeat.

Some installation guides are not really clear.

You can choose the free version and have all the features needed to collect and look for logs. There is a huge community, so in case of need you will easily find the answer to your question/problem.
The interface is simple and you can create your own dashboard with tables, graphs and counter (you can view your logs and create tables also with graphana, using elasticsearch as data source). You need to add at least an input, it can be for example an UDP one or for windows and linux machine filebeat on port 5044 (via sidecar).
You will see your sidecar devices on the Sidecars section.
You can create and save queries using lucene language, they will help you to find any potential threat logged.
Graylog server runs on a Linux Machine, installation is quite easy, there are lot of tutorials on internet.

some features are only on enterprise edition, the purge of inactive sidecar sometimes does not work (you have to restart graylog-server service)

All in one product. Lot of inputs available so you can ingest logs from a wide range of applications. Pipelines are a powerful tool to normalize data before indexing.

UI used to look "old". Now is getting much better but it still needs more love. The "single" designated master is not very cloud friendly. I'd like some kind of automated cluster management (with quorum to elect the master node) so we don't have to manually set one node as master while keeping our scaling operations.

We use graylog for Windows Server Events (Event Viewer) in one place, it´s very usefull.
The Alert Setup and new features like Pipelines (For disclose unknown error codes) is one plus in the Graylog.
The other Pro is the community forum and support.
Theres a VDA version ready to use. (Ubuntu)
Free Enterprise Licence with Traffic limitation ( normaly for one server / event aggregation)

If you need to custom setup with several graylog nodes is hard to get it running in the first try.
Some nice features are only available in Enterprise Edition.
No backup for Indexes is available , need to use external options.
Very hard post-config and clean the logs for the right information (need work)

1- Understand how different equipment, operating systems, databases, services and processes and different teams work in the organization.
2- Detecting security threats (in-depth analysis to find the source of the threat)
3. Dealing with cybercrime, using logs and traces of intrusion
4. Improve the process of managing applications, servers and services in real-time
5. In-depth and accurate checking of incoming and outgoing traffic at the packet level
6. Identify the relationship and correlation between logs and events
7. Identify any anomalies in different layers of IT the organization
8. Automate the process of detecting and reporting errors and anomalies to relevant teams in the organization
9. Perform normalization and immediate correlations of events and traffic
10. Provide real-time field of view and capture Network Flow data events In close proximity to advanced analytics, the service status is revealed
11.Prioritize alerts
12. Excellent speed and quality
13. Ability to write proprietary Content Pack
14. And hundreds more wonderful possibilities
15............

1-Speed and quality
2-Access to Content Pack
3-Being a user of Friendly
4-Support most softwares and devices
5-Good doc on the main site and internet

I like Graylog because of how easy it is to get logs flowing into the platform. Most of my experience has been with the AWS Cloudtrail plugin, but syslog wasn't hard either. The documentation works for most typical cases. I also love the new update! The dashboards are beautiful and it's easy to get any statistic you want. It's come a long way which shows dedication and a want to always be improving.

Most typical use cases are covered by the documentation, but if it isn't it can take some searching to figure out if there's a way to accomplish your goal. I have no experience with the enterprise or community support so I can't say how much that might help.