Active plans
4
Total changes
11
Last change
Jun 1, 2026
Price trend
Graylog Enterprise plan
What we know about Graylog’s pricing
VolatileChanges in 12 months
13
21 all-time
Cadence
Every 9 weeks
Direction
Recently restructured
Category position
—
Not enough peers tracked yet
Current pricing
Graylog Open
one timeFree
- one-time$0 one-time(Free)
- monthly$0/mo($0)
- Support for Syslog, CEF, GELF, BEATS, HTTP JSON, IPFIX, Netflow, Plain Text(true)
- Log Collection(true)
- Sidecar Central Log Collector Management(true)
- Index Field Type Profiles(true)
- Pipelines & Streams(true)
- Data Normalization(true)
- Collections(false)
- Asset History(false)
- Asset Event Definition(false)
- Visualization Widgets(true)
- Save to Dashboard(true)
- Guided Search(true)
- Save & Share (Search)(true)
- Filters(false)
- Parameters(false)
- Favorite Fields(true)
- Security Core Reports(false)
- AI Dashboard Summarization(false)
- Drill Down from Aggregation Widgets(true)
- Widget Thresholds and Labels(true)
- Text Widgets with Markdown(true)
- Revert Changes When Canceling Widget Edit(true)
- Data Table Row Numbers(true)
- Right-click Graylog + Custom Saved Searches(false)
- Scheduled Email Reports(false)
- Dashboard Drill Down(false)
- Custom Reports(false)
- Customizable Visualization Widgets(true)
- Save & Share (Dashboards)(true)
- Input Wizard(Partial)
- Illuminate Content Hub(Limited with free Illuminate content)
- Illuminate Content Parsers(Free packs only (open-source tools))
- Sharing Searches for Illuminate + Content Packs(false)
- Graylog Schema(Manual)
- REST API(true)
- Content Pack Import/Export(true)
- TCP RAW & TCP Syslog Outputs(true)
- Security Detection content (e.g. Sigma Rules)(false)
- Data Enrichment Connectors(true)
- IPinfo + MaxMind GeoIP(true)
- Lookup Tables(Static)
- Asset Data(false)
- Vulnerability Scan Support(false)
- MCP Server Integration for Natural Language Tools(true)
- AI Dashboard Summarization (Enrichment)(false)
- UEBA + Anomaly Detection (ML)(false)
- AI Investigation Report Generation(false)
- Basic Triggers and Aggregations(false)
- Alerting(false)
- Notifications(Basic)
- Automated Script Triggers(false)
- Correlation Engine(false)
- Sigma Rules(false)
- MITRE ATT&CK Framework Alignment(false)
- UEBA & Case Management(false)
- Compliance Reports(false)
- Asset-based Risk Scoring(false)
- Teams Management(false)
- OIDC / SSO Providers(false)
- Graylog User Audit Logs(false)
- Role-based Access(Internal)
- Multi Cluster(true)
- Enterprise Forwarder(false)
- Data Node (OpenSearch 2.19)(true)
- Data Lake(false)
- Data Tiering(false)
- Documentation(true)
- Graylog Academy(true)
- Graylog Community(true)
- Onboarding and Architecture Review Services(false)
- Technical Account Manager(false)
Graylog Enterprise
yearly$15,000/yr
- yearly$15,000/yr(Starting at $15,000/yr)
- one-time$15,000 one-time($15,000 one-time)
- Support for Syslog, CEF, GELF, BEATS, HTTP JSON, IPFIX, Netflow, Plain Text(true)
- Log Collection(true)
- Sidecar Central Log Collector Management(true)
- Index Field Type Profiles(true)
- Pipelines & Streams(true)
- Data Normalization(true)
- Collections(true)
- Asset History(false)
- Asset Event Definition(false)
- Visualization Widgets(true)
- Save to Dashboard(true)
- Guided Search(true)
- Save & Share (Search)(true)
- Filters(true)
- Parameters(true)
- Favorite Fields(true)
- Security Core Reports(false)
- AI Dashboard Summarization(false)
- Drill Down from Aggregation Widgets(true)
- Widget Thresholds and Labels(true)
- Text Widgets with Markdown(true)
- Revert Changes When Canceling Widget Edit(true)
- Data Table Row Numbers(true)
- Right-click Graylog + Custom Saved Searches(true)
- Scheduled Email Reports(true)
- Dashboard Drill Down(true)
- Custom Reports(true)
- Customizable Visualization Widgets(true)
- Save & Share (Dashboards)(true)
- Input Wizard(true)
- Illuminate Content Hub(true)
- Illuminate Content Parsers(Ops Content)
- Sharing Searches for Illuminate + Content Packs(true)
- Graylog Schema(Illuminate)
- REST API(true)
- Content Pack Import/Export(true)
- TCP RAW & TCP Syslog Outputs(true)
- Security Detection content (e.g. Sigma Rules)(false)
- Data Enrichment Connectors(true)
- IPinfo + MaxMind GeoIP(true)
- Lookup Tables(Dynamic)
- Asset Data(false)
- Vulnerability Scan Support(false)
- MCP Server Integration for Natural Language Tools(true)
- AI Dashboard Summarization (Enrichment)(true)
- UEBA + Anomaly Detection (ML)(false)
- AI Investigation Report Generation(false)
- Basic Triggers and Aggregations(true)
- Alerting(true)
- Notifications(Advanced)
- Automated Script Triggers(true)
- Correlation Engine(true)
- Sigma Rules(false)
- MITRE ATT&CK Framework Alignment(false)
- UEBA & Case Management(false)
- Compliance Reports(true)
- Asset-based Risk Scoring(false)
- Teams Management(true)
- OIDC / SSO Providers(true)
- Graylog User Audit Logs(true)
- Role-based Access(AD or LDAP)
- Multi Cluster(true)
- Enterprise Forwarder(true)
- Cluster to Cluster Forwarder(true)
- Cloud Forwarder(true)
- Data Node (OpenSearch 2.19)(true)
- Data Lake(true)
- Data Lake Preview and Selective Retrieval(true)
- Amazon Data Lake Preview + Retrieval(true)
- Filtered AWS Security Lake Input(true)
- Lake Retrievals Page(true)
- Data Tiering (Hot, Warm, Archive)(true)
- HDFS Warm Tier Support(true)
- Documentation(true)
- Graylog Academy(true)
- Graylog Community(true)
- Onboarding and Architecture Review Services(true)
- Technical Account Manager(Optional add-on)
Graylog Security
yearly$18,000/yr
- yearly$18,000/yr(Starting at $18,000/yr)
- one-time$18,000 one-time($18,000 one-time)
- Support for Syslog, CEF, GELF, BEATS, HTTP JSON, IPFIX, Netflow, Plain Text(true)
- Log Collection(true)
- Sidecar Central Log Collector Management(true)
- Index Field Type Profiles(true)
- Pipelines & Streams(true)
- Data Normalization(true)
- Collections(true)
- Asset History(true)
- Asset Event Definition(true)
- Visualization Widgets(true)
- Save to Dashboard(true)
- Guided Search(true)
- Save & Share (Search)(true)
- Filters(true)
- Parameters(true)
- Favorite Fields(true)
- Security Core Reports(true)
- AI Dashboard Summarization(true)
- Drill Down from Aggregation Widgets(true)
- Widget Thresholds and Labels(true)
- Text Widgets with Markdown(true)
- Revert Changes When Canceling Widget Edit(true)
- Data Table Row Numbers(true)
- Right-click Graylog + Custom Saved Searches(true)
- Scheduled Email Reports(true)
- Dashboard Drill Down(true)
- Custom Reports(true)
- Customizable Visualization Widgets(true)
- Save & Share (Dashboards)(true)
- Input Wizard(true)
- Illuminate Content Hub(true)
- Illuminate Content Parsers(All Content)
- Sharing Searches for Illuminate + Content Packs(true)
- Graylog Schema(Illuminate)
- REST API(true)
- Content Pack Import/Export(true)
- TCP RAW & TCP Syslog Outputs(true)
- Security Detection content (e.g. Sigma Rules)(true)
- Data Enrichment Connectors(true)
- IPinfo + MaxMind GeoIP(true)
- Lookup Tables(Dynamic)
- Asset Data(true)
- Vulnerability Scan Support(true)
- MCP Server Integration for Natural Language Tools(true)
- AI Dashboard Summarization (Enrichment)(true)
- UEBA + Anomaly Detection (ML)(true)
- AI Investigation Report Generation(true)
- Basic Triggers and Aggregations(true)
- Alerting(true)
- Notifications(Advanced)
- Automated Script Triggers(true)
- Correlation Engine(true)
- Sigma Rules(true)
- MITRE ATT&CK Framework Alignment(true)
- UEBA & Case Management(true)
- Custom Detectors(true)
- Evidence Collection(true)
- Investigation Timeline Visualization and Analytics(true)
- Event Procedures (Guided Steps)(true)
- Automation(true)
- Guided Response and Workflow(true)
- Third Party SOAR and Ticketing Integration(Add-on)
- Compliance Reports(true)
- Asset-based Risk Scoring(true)
- Events and Alerts Risk Scoring(true)
- Adversary Campaign Intelligence(true)
- Field Actions with Threat Intel Lookups and Watchlists(true)
- Threat Coverage Analyzer and Visualization(true)
- Vulnerability Scan Ingest(true)
- Teams Management(true)
- OIDC / SSO Providers(true)
- Graylog User Audit Logs(true)
- Role-based Access(AD or LDAP)
- Multi Cluster(true)
- Enterprise Forwarder(true)
- Cluster to Cluster Forwarder(true)
- Cloud Forwarder(true)
- Data Node (OpenSearch 2.19)(true)
- Data Lake(true)
- Data Lake Preview and Selective Retrieval(true)
- Amazon Data Lake Preview + Retrieval(true)
- Filtered AWS Security Lake Input(true)
- Lake Retrievals Page(true)
- Data Tiering (Hot, Warm, Archive)(true)
- HDFS Warm Tier Support(true)
- Documentation(true)
- Graylog Academy(true)
- Graylog Community(true)
- Onboarding and Architecture Review Services(true)
- Technical Account Manager(Optional add-on)
Graylog API Security
yearly$18,000/yr
- yearly$18,000/yr(Starting at $18,000/yr)
- one-time$18,000 one-time($18,000 one-time)
- API Discovery and Protection(true)
- End-to-end API Security(true)
Price history
Last 11 changes
$15,000→$15,000(0.0%)
| Date | Plan | Change | Old | New | Δ% |
|---|---|---|---|---|---|
| Jun 1, 2026 | Graylog Enterprise | restructure | — | $15,000 | — |
| Jun 1, 2026 | Graylog Security | restructure | — | $18,000 | — |
| Jun 1, 2026 | Graylog API Security | restructure | — | $18,000 | — |
| May 17, 2026 | Graylog API Security | new plan | — | — | — |
| May 17, 2026 | Graylog Security | new plan | — | — | — |
| May 17, 2026 | Graylog Enterprise | new plan | — | — | — |
| May 17, 2026 | Graylog Open | new plan | — | $0 | — |
| Oct 7, 2025 | Graylog Enterprise | new plan | — | $15,000 | — |
| Oct 7, 2025 | Graylog Security | new plan | — | $18,000 | — |
| Oct 7, 2025 | Graylog API Security | new plan | — | $18,000 | — |
Showing the most recent 10 changes. Full history back to 2023 is available through the developer API.
Similar to Graylog.
No confirmed competitors yet. These are DevOps & Monitoring products at a similar price, matched automatically — not verified alternatives.