Gravwell pricing in 2026: the node-based, unlimited-ingest model
The independent Gravwell pricing reference. The indexer/node-based meter explained (unlimited ingest, retention, search and users, with no per-GB charge), the free 2 GB/day Community Edition, the Professional, Enterprise and Cloud tiers, why paid pricing is sales-quoted, and what happens to a node-metered bill when log volume doubles. Built from Gravwell's published pricing and product pages. Updated August 2026.
All figures from gravwell.io/pricing and Gravwell's product and blog pages, verified 17 August 2026. Gravwell publishes the model and the free-tier limit but no dollar figures for the paid tiers; those are quoted by sales, and this page does not extrapolate numbers the vendor has not published.
What Gravwell is, and how node-based pricing works
Gravwell is a security data and data-fusion platform. It ingests data from any source in raw, unstructured form, structure-on-read, with no schema or normalisation required at intake, and unifies logs, metrics and security data in one system that runs on-premises, in the cloud or hybrid. It serves both cyber-security investigation and threat hunting and operational-technology use cases. It was co-founded by Corey Thuen (CEO) and Kris Watts, is based in Idaho, and raised a $15.4 million Series A led by Two Bear Capital. The positioning is built around collecting everything without a volume penalty, and the pricing model is where that shows up most concretely.
The meter is indexers, not ingest. Gravwell's pricing page states the model directly: pricing is based on the number of indexers in the cluster, and each indexer has unlimited ingest capacity. Its cost-series blog is blunter still, that it does not price based on data rates and that every deployment includes unlimited data, it is your storage, use it. Among the vendors this site tracks, that makes Gravwell a third distinct pricing shape. Splunk and Sentinel meter ingested volume; storage-model vendors meter what you retain; Gravwell meters neither and instead prices the infrastructure, the indexer nodes, you stand up to search and keep the data.
The published structure has a free tier and three commercial options. Community Edition is free, capped at 2 GB/day of real ingest, and includes the full platform, all search modules, ingesters and orchestration, aimed at home use and individual analysts. The commercial tiers are Professional and Enterprise, both self-hosted, and Cloud, a Gravwell-managed deployment. All three advertise the same unlimited feature set: unlimited data ingestion, unlimited retention, unlimited search count, unlimited users and unlimited automations, with tiered storage and cloud archive on the managed option.
What is not published matters as much. Gravwell lists no dollar figure for any paid tier. The pricing page carries the model and the tier names but routes to a request-pricing form, so the commercial number arrives through a sales conversation sized on indexer count and deployment. The only dollar amount on a Gravwell pricing page is a competitor illustration in the cost blog, a $600 per GB/day/year scenario attributed to ingest-priced tools, which is not Gravwell's own price. This page reflects the model Gravwell publishes and does not invent the tier figures it withholds.
Gravwell tier reference
| Tier | Price | What is published |
|---|---|---|
| Community Edition | Free | Capped at 2 GB/day of real ingest. Full platform: all search modules, ingesters and orchestration. Aimed at home use and individual analysts. |
| Professional (self-hosted) | Sales-quoted | Priced by indexer count. Unlimited data ingestion, retention, search count, users and automations. Runs in your own infrastructure. |
| Enterprise (self-hosted) | Sales-quoted | Priced by indexer count, with enterprise features on top of Professional. Same unlimited-data feature set. Self-hosted. |
| Cloud (managed) | Sales-quoted | Gravwell-hosted managed deployment. Same unlimited-data model plus tiered storage / cloud archive. No public rate card. |
Source: gravwell.io/pricing and the Community Edition announcement, verified 17 August 2026. Community Edition publishes an exact limit (free, 2 GB/day ingest). The three commercial tiers publish the model and feature set but no dollar figures; pricing is quoted by sales on indexer count. This page reflects the listed model and deliberately does not fill the gaps with invented numbers.
The doubling test: what happens when a new service doubles your logs
The cleanest way to see what a node model changes is to run the same event through both meters: your platform team ships a new service and raw log volume doubles overnight.
The ingest-side arithmetic uses Microsoft Sentinel's published $4.30 per GB PAYG rate from our Sentinel pricing page; commitment tiers soften the doubling (to $2.96 effective at 100 GB/day) but the bill still scales with ingested volume. The Gravwell column is deliberately qualitative: because each indexer carries unlimited ingest, doubling raw volume adds no per-GB charge, and the bill only moves if the extra data forces more indexers for search or retention performance. Gravwell publishes no rate card, so the honest statement is directional, not a dollar figure.
Node meter vs ingest meter, across this site's references
| Platform | What is metered | Published anchor | Raw volume doubles |
|---|---|---|---|
| Gravwell | Indexer / node count (unlimited ingest per node) | No published dollar figure; Community free at 2 GB/day, paid tiers sales-quoted by indexer count | Ingest is unmetered; the bill moves only if you add indexers for search or retention headroom |
| Splunk Cloudfigures: /splunk-pricing | Ingested GB/day (or SVC workload units) | Roughly $665 to $1,620 per GB/day per year depending on commit volume | Metered volume doubles; the ingest bill roughly doubles |
| Microsoft Sentinelfigures: /sentinel-pricing | Ingested GB (per-GB meter) | $4.30 per GB PAYG, $2.96 effective at the 100 GB/day commitment tier | Metered volume doubles; commitment tiers soften but do not remove it |
| Pantherfigures: /panther-pricing | Ingested TB/month | $50,000/yr per 1 TB/month on the AWS Marketplace listing | Metered volume doubles; the volume meter roughly doubles |
Comparison rates are the ones already documented on this site's vendor pages, linked per row, each verified against the vendor's published pricing on the date shown on that page. The structural point is meter placement: an ingest meter prices every gigabyte that arrives, and Gravwell's node meter prices the indexers you run regardless of volume. Which lands cheaper for you depends on how much you ingest, how unpredictable it is, and how much infrastructure a node deployment needs for your search and retention targets.
Who the node model fits, and who it does not
- + High or spiky ingest: unlimited per-node ingest means volume spikes carry no per-GB penalty
- + Long retention matters: unlimited retention is part of the model, not a priced add-on
- + You want to collect everything: the whole pitch is not being forced to under-collect to control cost
- + On-prem, hybrid or OT/industrial data: self-hosted Professional and Enterprise tiers exist for exactly this
- + Individual analysts and evaluators: the free Community Edition (2 GB/day, full platform) is usable, not a timed trial
- - Small, steady, low ingest: a metered per-GB tier may cost less than standing up indexers
- - You need a rate card before talking to sales: paid tiers publish no dollar figures
- - You do not want to run infrastructure: self-hosted tiers push node and storage ops onto you
- - Procurement wants itemised meters: cost lives in node count and storage, not line-item GB/query/seat
- - Mature workflows built on an incumbent: migration effort, not pricing model, is the binding constraint
The compute and infrastructure question
Every SIEM bill has a compute component somewhere; the models differ mainly in where it sits and whether you run it. Ingest-priced platforms fold search and detection compute into the per-GB rate. Workload-priced models meter compute directly. Gravwell's node model puts compute in the indexers themselves: you provision nodes, and their capacity is what serves ingest, search and retention.
That has a clear upside and a clear cost. In its favour, there is no volume meter to fear, unlimited ingest and retention are stated features, and a heavy investigation month does not produce a surprise per-query bill. Against it, the self-hosted tiers mean you run the infrastructure, indexer nodes and their storage, so operational effort and hardware or cloud-compute cost move onto your side of the line, and because paid pricing is sales-quoted there is no public rate card to forecast against before you talk to Gravwell. On this site's usual transparency framing, Gravwell is highly transparent about the model (nodes, unlimited data) and opaque about the commercial number, which it gates behind sales. The practical question for a buyer is whether they would rather forecast gigabytes on a published meter or indexer count on a quoted one.
Verify before you buy
As with every vendor page on this site: the figures above were verified against Gravwell's published pages on 17 August 2026, and SIEM pricing changes frequently. Before signing anything, confirm the current model at gravwell.io/pricing, get the indexer count behind your quote and what it supports for your workload in writing, and ask directly how many indexers your ingest and retention targets imply, how the self-hosted infrastructure cost (nodes and storage) sits alongside the Gravwell licence, and what Community Edition's retention and seat limits are if you plan to evaluate on it. Our methodology page explains how figures on this site are sourced and what verification means.