Graylog pricing in 2026: Open, Enterprise, Security, and the consumption model

Graylog has a clean four-way structure. Graylog Open is free and source-available: the full log management core, self-hosted on your own infrastructure. Graylog Enterprise, from $15,000 per year, adds enterprise support, advanced reporting, archiving, correlation, and the Illuminate content on top. Graylog Security, from $18,000 per year, builds on Enterprise and adds the SIEM layer of detections, anomaly detection, threat intelligence, and SOC workflows. Graylog Cloud is the fully managed option, priced through sales.

Both paid editions are consumption-priced, tied to daily log volume or annual consumption rather than a published per-gigabyte rate. The $15,000 and $18,000 figures are the stated starting points; the real number for your deployment is set during the sales engagement based on the volume you license. That is the key nuance: Graylog gives you a transparent floor, but the slope above it is negotiated on volume, not published as a step table.

The free Open edition is genuinely useful, which shapes the buying pattern. Many teams run production centralised logging on Graylog Open and only move to a paid edition when they need a specific capability: enterprise support and archiving push them to Enterprise, and the need for active security detection pushes them to Security. Because the upgrade path is feature-driven rather than forced, the sensible approach is to prove the deployment on Open, then buy the edition whose features you can actually name.

The self-managed versus cloud choice is the other lever. Self-managed Graylog means running the OpenSearch and MongoDB backend and owning the operations, which avoids the managed premium but costs engineering time. Graylog Cloud removes the ops burden at a price set through sales. For teams with platform engineering capacity, self-managed Enterprise is usually cheaper all-in; for lean teams, Cloud can win once operational time is counted honestly.

Graylog wins for teams that want strong centralised log management with a clean, affordable path into security analytics. The free Open edition lets you prove the platform in production, the paid editions start at published five-figure entry points rather than opaque six-figure quotes, and Graylog Security adds a real SIEM layer without changing platforms. It fits mid-market SOCs, log-management-first engineering teams, and organisations that value a source-available foundation and predictable upgrade economics.

Graylog is less compelling at the very top of the volume range, where hyperscale cloud-native telemetry and the deepest threat-hunting workloads favour security data lakes and the largest enterprise SIEMs, and where the consumption pricing above the entry point is negotiated rather than transparent. If your requirement is enormous ingest with advanced analytics and a mature app ecosystem, weigh Graylog against Splunk, Sentinel, and Chronicle; if it is capable, cost-controlled logging and SIEM for a mid-market estate, Graylog is often the most economical serious option.