Graylog Implementation: Centralized Logging, Alerting, GELF

Note: when logs exceed 100 GB per day, grep and tail become unusable. We've encountered projects where error search took hours, and alerts were configured manually via cron. Once, on a project with 200 microservices, we spent a week investigating an incident because logs were scattered across 50 hosts. Our experience with Graylog is about eliminating chaos: centralized collection, fast search, and flexible alerting out of the box. We don't just deploy Graylog—we configure it for your infrastructure: from Docker Compose to a production cluster with OpenSearch and load balancing. We guarantee stable operation and a 3-5x reduction in MTTR. With proper configuration, log storage costs drop 30-50% thanks to efficient retention and compression.

Problems We Solve

• Scattered logs — logs on hundreds of servers piled on a single filesystem. Graylog aggregates them into a unified store with search in seconds.
• Noise and alerts — useless notifications for every sneeze. We configure streams and pipeline rules so alerts arrive only for real errors.
• Slow incident search — grep through 50 GB of logs takes minutes. Graylog with OpenSearch responds in milliseconds.

Why Graylog Over ELK?

ELK is a powerful stack, but it requires separate setup for Logstash, Kibana, and Elasticsearch. Graylog offers the same functionality with a lower entry barrier: built-in UI for parsing, alerts, and stream management.

Based on client feedback, after Graylog implementation, incident analysis time dropped from hours to minutes, and team workload was halved.

How We Do It

Deployment via Docker Compose

# docker-compose.yml
version: '3'
services:
  mongodb:
    image: mongo:6.0
    volumes:
      - mongo-data:/data/db
    restart: unless-stopped
  opensearch:
    image: opensearchproject/opensearch:2.11.0
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms2g -Xmx2g"
      - "bootstrap.memory_lock=true"
      - "discovery.type=single-node"
      - "action.auto_create_index=false"
      - plugins.security.disabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - os-data:/usr/share/opensearch/data
    restart: unless-stopped
  graylog:
    image: graylog/graylog:5.2
    environment:
      GRAYLOG_PASSWORD_SECRET: ${GRAYLOG_PASSWORD_SECRET}
      GRAYLOG_ROOT_PASSWORD_SHA2: ${GRAYLOG_ROOT_PASSWORD_SHA2}
      GRAYLOG_HTTP_EXTERNAL_URI: http://graylog.example.com:9000/
      GRAYLOG_MONGODB_URI: mongodb://mongodb/graylog
      GRAYLOG_ELASTICSEARCH_HOSTS: http://opensearch:9200
      GRAYLOG_TIMEZONE: Europe/Kiev
    depends_on:
      - mongodb
      - opensearch
    ports:
      - "9000:9000" # Web UI
      - "1514:1514" # Syslog TCP
      - "1514:1514/udp" # Syslog UDP
      - "12201:12201" # GELF TCP
      - "12201:12201/udp" # GELF UDP
      - "5044:5044" # Beats
    volumes:
      - graylog-data:/usr/share/graylog/data
    restart: unless-stopped
volumes:
  mongo-data:
  os-data:
  graylog-data:

Generate GRAYLOG_ROOT_PASSWORD_SHA2 by running echo -n "YourPassword" | sha256sum | cut -d" " -f1.

GELF: Native Graylog Format

GELF (Graylog Extended Log Format) is a JSON format designed specifically for Graylog. The advantage over syslog is that it supports arbitrary fields without parsing:

{ "version": "1.1",
  "host": "app-server-01",
  "short_message": "Payment processing failed",
  "timestamp": 1705312800.123,
  "level": 3,
  "_user_id": "u-12345",
  "_order_id": "ord-987654",
  "_payment_provider": "stripe",
  "_error_code": "card_declined",
  "_amount_cents": 4999 }

Fields with _ prefix are additional. In Graylog, they are immediately available as separate fields for filtering and aggregation.

How to Send Logs to Graylog via GELF

To start sending logs to Graylog:

1. Configure a GELF input in Graylog (default port 12201 TCP/UDP).
2. In your application, add a GELF appender library (e.g., logback-gelf for Java).
3. Add static fields (application, env, version) for convenient filtering.

Example for Java (logback):

<!-- logback.xml -->
<appender name="GELF" class="de.siegmar.logbackgelf.GelfUdpAppender">
  <graylogHost>graylog</graylogHost>
  <graylogPort>12201</graylogPort>
  <maxChunkSize>508</maxChunkSize>
  <useCompression>true</useCompression>
  <encoder class="de.siegmar.logbackgelf.GelfEncoder">
    <includeRawMessage>false</includeRawMessage>
    <includeMarker>true</includeMarker>
    <includeMdcData>true</includeMdcData>
    <staticField>app_name:payment-service</staticField>
    <staticField>env:production</staticField>
  </encoder>
</appender>

After this, all application logs will be automatically sent to Graylog with the required fields. For more details on GELF setup, see the official documentation.

Pipeline Rules: Transformation Without Logstash

Graylog Processing Pipelines is a DSL for transforming messages directly inside Graylog. Example rule for enriching HTTP logs:

rule "parse_http_status"
  when
    has_field("http_status_code")
  then
    let status = to_long($message.http_status_code);
    let category = if(status >= 500, "server_error", if(status >= 400, "client_error", if(status >= 300, "redirect", "success")));
    set_field("status_category", category);
end

How to Configure Alerting in Graylog?

Streams are the message routing mechanism in Graylog. A stream with a condition application_name:payment-service AND level:<=3 isolates all errors from the payment service, to which an alert condition and a separate index set with different retention can be attached.

Alert condition via API:

POST /api/streams/{stream_id}/alerts/conditions
{
  "type": "message_count",
  "title": "Too many errors",
  "parameters": {
    "time": 5,
    "threshold_type": "MORE",
    "threshold": 100,
    "grace": 2,
    "backlog": 10
  }
}

Process

Estimated Timeline

Full Graylog deployment with Inputs, Pipeline Rules, Streams, and alerting — from 3 to 5 days. Includes testing and handover to operations. Cost is calculated individually — contact us to evaluate your project.

Typical Graylog Implementation Mistakes

• Forgetting to configure index rotation — disk fills up in a week.
• Using syslog for structured logs — loses fields. Better to use GELF.
• Not configuring pipeline rules — logs arrive as strings, impossible to search.
• Too frequent alerts — exhaust the team. Set up grace periods and severity levels.

What's Included

• Graylog deployment (Docker Compose or cluster)
• Input setup (syslog, GELF, Beats, JSON)
• Pipeline rules for parsing and enrichment
• Streams and alerting creation
• Integration with your notification systems (email, Slack, Telegram)
• Documentation and training
• 30-day configuration warranty

Order turnkey Graylog setup — we'll evaluate your project in 1 day. 7+ years of experience, over 50 implementations.