Graylog Enterprise Reviews

We are working with Splunk Enterprise Security. I use it in the company. I am only using this Splunk product.

It is easier to find some issues, and if I find some issues, then it is easier to resolve them. It is not so difficult.

We stopped using Graylog Enterprise because we found some issues with logs that came through, and they were too difficult to parse. We saw that it was better to use Splunk. It is better because it has an analysis algorithm and can also draw graphics with some help with this. To use Graylog Enterprise, we needed to import another system that collects and correlates the logs to see the statistics.

I did not find the alerting systems in Graylog Enterprise adequate to maintain operational efficiency. It was acceptable, but our company is developing, so we needed to improve and see different analysis and different ways to see the data. For this reason, we decided to buy a new SIEM platform where we could improve some additional features.

The problem was with the complexity and the cost to add extensions. We found this very expensive to buy another version with additional features.

I think that Graylog Enterprise does not have customizable dashboards. I did not see them in Graylog Enterprise because most of the time we used the open source free version, which is limited.

I think Graylog Enterprise should improve some things that they have in the paid version and perhaps provide users with a menu that gives examples of parsing logs and draws graphics so that people do not need to improve another system such as Grafana. This would be interesting.

When it comes to functionalities, I found the log management in Graylog Enterprise acceptable. It is very simple to use and to collect logs. It has support for different protocols and different ports, and the sidecar is easy to use. However, in visualization, I think it needs to be much better.

I have been working with Graylog Enterprise for about two to three years.

I never contacted technical support by Graylog Enterprise.

Negative

We stopped work with Graylog Enterprise and now we use another SIEM platform. We do not use Graylog Enterprise anymore. We stopped using Graylog Enterprise and switched to Splunk about seven to eight months ago.

We also tried Wazuh and QRadar.

We are now working with Splunk and Wazuh. We used Graylog Enterprise for log management. I did not utilize Graylog Enterprise's advanced search capabilities. When we installed and used Graylog Enterprise, it was sufficient. If I were to give a mark, it would be around seven to eight, or perhaps 7.5. We only used Graylog Enterprise for log management, and for this, I did not use anything. All that I did was manually follow the logs, take them manually, and do some parsing to see them in a better way. I think for this open source product with limited features, for a middle-sized company, it would be around nine, or perhaps even ten. I would rate this review a 7.5 overall.

I used Graylog Enterprise in the context of a SOC, so I used it for log monitoring and also for security purposes.

During investigations in the SOC context, I ran some queries in Graylog Enterprise to identify suspicious activities, IP addresses, and users, allowing us to track all activity.

Regarding automation in Graylog Enterprise, when we created use cases, whether for VPN access or brute force, if it matched the query, we would receive the alert in the corporate email. Upon receiving it in the corporate email, we had automation that would send it directly to the Teams group for the clients.

The positive impact of Graylog Enterprise on my organization is that it provides visibility into activity, leading to client satisfaction because we were able to track all activity from the root cause to the user's final activity to determine whether it was something malicious or legitimate.

Definitely, with the visibility provided by Graylog Enterprise, you do not have to assume things that might have happened; you really know what happened, which allows you to provide clearer information about the alert and also for the client.

I think one of the positive points Graylog Enterprise offers is this centralization of logs, which greatly facilitates investigation work. Another point is its ability to perform searches, apply filters, and run queries so that you can look for a specific event, user, or IP.

I think Graylog Enterprise brought efficiency gains because when you run a search or do some research, you can save it, so you do not need to enter the query again; you just retrieve what is already saved.

I think the main point regarding Graylog Enterprise features is that it helps a lot in event analysis and identification because it brings in a lot of logs and a lot of information, so you can access all the information about the alert there.

I believe Graylog Enterprise's AI features are very good, allowing you to use AI to run specific searches, which brings a lot of results.

Regarding the AI features of Graylog Enterprise, I did not use them in such depth as to accurately evaluate their reliability, but I believe that AI can help speed up analysis and identify some suspicious patterns, though it is important that the result is always validated by an analyst.

I think one aspect of Graylog Enterprise that could be improved is that it could be more intuitive, especially for someone just starting to use it, as depending on the amount of logs and the complexity of the query, it might require a bit more technical knowledge.

Regarding necessary improvements for Graylog Enterprise, I think integration is a point that could be improved because it is very technical, so it would be good to make some search and visualization features easier.

I used Graylog Enterprise for two years, but currently, I no longer use it.

I believe Graylog Enterprise is stable; it provides a lot of information about alerts, allowing good visibility of the client's environment.

Definitely, Graylog Enterprise handles data and user growth well, as I think the more space you contract, the more you will be able to use it.

I did use customer support for Graylog Enterprise; sometimes it stopped bringing in logs, so we had to call support to see what was happening, and it was always answered very proactively.

I would rate customer support a 10 because we were always very well served.

In my previous job, I used CrowdStrike Falcon, but in my current job, we stopped using Graylog Enterprise and started using SentinelOne.

We had contracted an AWS cloud, so we used their cloud to host Graylog Enterprise.

I believe we achieved a return on investment by using Graylog Enterprise, as for about two years, it was our main SIEM tool to run the SOC environment for clients, enabling us to have full visibility and deliver results regarding information security.

I worked in the SOC environment focusing more on analyzing alerts, but I was able to understand the configurations well, including setting up use cases and automations.

I would rate Graylog Enterprise an eight.

I believe the negative points that I mentioned, about it needing to be more intuitive and requiring a lot of technical knowledge to use the tool effectively, are why I did not give it a 10.

I believe that nowadays for a SOC environment, we have more complete solutions, but if you want a SIEM exclusively for log analysis and full visibility, I highly recommend Graylog Enterprise.

Graylog Enterprise is used primarily for log management and to perform security analytics. It helps the organization collect logs from different sources and centralize them in one place. We can search and analyze events, detect suspicious activity, and it supports security investigations. The organization ingests a lot of logs including firewall logs, AWS, Windows endpoints, and authentication logs. It helps collect everything in a single dashboard, and we can search the logs and monitor each aspect.

Graylog Enterprise collects everything in one dashboard, allowing the SOC team to search the logs and monitor every alert based on the rules, enabling investigation of suspicious activity. For example, if a user account suddenly logs in from an unusual or unauthorized location with multiple failed login attempts, Graylog helps correlate those logs and allows analysts to investigate that quickly.

Graylog Enterprise is used for compliance and audit log retention, for investigation, and it is useful for centralized log collection.

In alerting and correlation, logs are ingested from multiple sources, allowing us to create alerts based on those use cases. For example, if a suspicious IP from an unauthorized location is detected, the IP is checked in the firewall logs, application logs, or whether it has executed some PowerShell script or is showing some authentication behavior. Based on that, everything is correlated, and those insights are available in the tool for SOC analysts to analyze those alerts.

The best feature Graylog Enterprise offers is its centralized log management, allowing analysts to search logs from a single tool instead of checking multiple tools. It is fast, and we can search effectively because during incident response time, the SOC analyst can quickly search a suspicious IP, username, or any IOCs across the historical logs. Another valuable aspect is the alerting and correlation functionality, where alerts can be created for multiple rules based on use cases, such as multiple failed logins, privilege escalation, abnormal authentication behavior, and other security events.

The dashboard and visualization in Graylog Enterprise is good for SOC monitoring purposes.

Graylog Enterprise positively impacts the organization by helping the team and analysts investigate incidents faster since logs from servers, endpoints, cloud, and firewalls are available in one place. Instead of switching between multiple tools, timelines can be reviewed and suspicious activity validated quickly, resulting in faster investigation times, better visibility into logs, and improved incident response capabilities. This has also reduced manual effort and compliance tasks.

Previously, as an SMB company, approximately 40 to 50 alerts per day were generated. When Graylog Enterprise was implemented and evaluated, it correlated everything, providing true positive alerts and reducing the number of alerts to 10, which allows analysts to monitor those true positive alerts and take action accordingly.

Graylog Enterprise performs well overall; however, the UI could be improved because the SOC team creates multiple dashboards based on their use cases, and creating dashboards is complex. If there were multiple dashboard and chart styles available, it would be helpful for the team and for the SOC analysts to investigate and use the UI in a better way.

I have been working as a cybersecurity engineer for six years.

Enterprise-grade platforms like Graylog Enterprise are expected to be stable for security purposes as well as monitoring workloads, and the experience has been good.

Graylog Enterprise is designed to be capable of handling growing workloads effectively.

The support experience generally depends on the issue complexity, but the team was very responsive and their technical guidance was also very good and constant. I would rate the customer support around nine out of ten.

Previously, Elasticsearch, an open-source SIEM tool, was used, and multiple monitoring approaches were evaluated depending on maturity and requirements.

Graylog Enterprise is a security product and generally requires an evaluation. Multiple tools were evaluated, and the solution will need to be scaled if required, as the main cost depends on integration and operation requirements. These details will be shared with leadership, and they will make the decision.

Graylog Enterprise was purchased from a Graylog salesperson, a third-party salesperson.

Instead of having five analysts working, Graylog Enterprise has reduced the number of analysts as well as time, resulting in a decreased cost of 20%. It has provided better quality and improved detection capabilities.

The organization often compares Graylog Enterprise with other SIEM and detection solutions tools based on the integration, and it is upon leadership's decision.

If others are looking into using Graylog Enterprise and have multiple log sources that they need to monitor and correlate, I would recommend Graylog Enterprise. It is a good product, allowing them to ingest all the logs into a single platform where they can search, triage, create rules, and monitor every alert.

Graylog Enterprise is a good, secure SIEM platform with mature investigation capabilities that works best when integrated into multiple log sources. I rate this product an eight out of ten.

I remember using Graylog Enterprise in the past at a software house where we used it for logging. During that time, we were using Graylog Enterprise as a log aggregator, collecting logs from multiple systems and then exporting and visualizing them within Graylog.

We had multiple Linux-based machines, and we were trying to capture the logs from the systems and export them into Graylog so that they could be centrally visualized. Graylog Enterprise was deployed on-premises in a private cloud.

In my experience, if I compare Graylog Enterprise with the ELK stack, I can see that Graylog is way easier to set up and has a great, good-looking UI. These are the things where I could see Graylog as a lightweight tool with more flexibility in terms of setting it up compared to alternatives such as ELK.

In the case of Elasticsearch, multiple separate components are needed. However, in the case of Graylog Enterprise, there was only one binary that we used to install on the machines.

Graylog Enterprise has positively impacted my organization by enhancing visibility through improved monitoring capabilities and getting logs from all the machines, which contributed to enhanced visibility and monitoring. We had over 500 virtual machines, and monitoring the logs by going to each virtual machine was tedious in the past. With Graylog, all the logs from those 500 machines were centralized in one Graylog Enterprise system. From there, it was very easy to query the logs and see the patterns, and thus the monitoring was significantly enhanced.

With Graylog Enterprise, monitoring improved by up to 80 percent because of having all the logs centralized. Users or engineers would not have to SSH on each node to see the logs, meaning monitoring or visibility got improved by 80 percent or more.

The documentation for Graylog Enterprise can be improved, as this has been a pain point.

I think the visualization aspect of Graylog Enterprise can be made more rich, similar to what we have in Grafana. If upgrades could be made more smooth, as we encountered fragile upgrades while doing upgrades in the past, then I think that could be great.

I used Graylog Enterprise in the past for one year.

Graylog Enterprise is stable.

The customer support for Graylog Enterprise was good and responsive.

I previously used Splunk and ELK as well, but they were with a different employer. It was never a situation where Graylog Enterprise was introduced as a replacement for other tools; the employer I was talking about was primarily using it.

I am not sure about the pricing, setup cost, and licensing because that was dealt with by a different team that handled the licensing and procurement.

No options were evaluated before choosing Graylog Enterprise.

I would say it depends on the scenario. If you have logs and want to have an easier setup, then Graylog Enterprise is the best choice. However, if you go towards a more complex architecture, then you could use other options such as ELK or Splunk. Graylog Enterprise, as far as logging is concerned, in terms of a small-scale setup and ease of use, is the best choice to go with. My overall rating for Graylog Enterprise is 7 out of 10 because of its flexibility and lightweight nature.

The advice I would give to others looking into using Graylog Enterprise is to ensure that the data they are collecting is actually in a proper format so that it can be viewed more clearly within Graylog Enterprise's interface, focusing on the formatting of the data.

My main use case for Graylog Enterprise was as a SIEM for log analysis and to support information security activities, providing a consolidated view of the logs. Graylog Enterprise allowed me to work with event information from the technological environment, and I was able to adapt its features because it is a flexible tool for that purpose.

A specific example of how I used Graylog Enterprise in my work is that I utilized it as a SIEM at my previous company.

I hope that soon, at my current company, I will be able to implement it in some way and adapt it to our needs.

Graylog Enterprise has positively impacted my organization mainly through the visibility and faster identification of problems that may appear, along with alerts when something is critical.

Using alerts has made a difference for my organization because it works with a centralization of logs, providing me with centralized alerts directly from it. I did not need to keep configuring alerts in each of the tools that were integrated with it.

The best features Graylog Enterprise offers, in my opinion, are its flexibility and the ability to adapt it to my needs, configure integrations, and its very clear filters. The rules and alerts were very important, and I found configuring those alerts to be very flexible.

These features help me with my work on a daily basis by making it easier to visualize the logs and centralize them without me having to keep checking tool by tool. I believe that the central point is that it made it easier to have this visibility.

Graylog Enterprise could be improved by incorporating a way to build executive reports that are not too technical, so they can be presented to upper management, who are usually not from the security area. It could also enhance some processes for a better view.

I would like to see improvements in alert levels, user access levels, and other areas. I understand that Graylog Enterprise is not a SIEM; it is a log management tool. However, it was able to meet my needs for security log monitoring specifically.

I used Graylog, both the Open Source version and then the Enterprise version, in my first opportunity working in information security. Due to some certifications I have in the field, which I achieved before entering the area, I was hired directly as the head of information security, the person responsible for information security. I decided that Graylog Enterprise should be implemented so it could serve as a SIEM for our logs and our security operations.

On a scale of one to ten, I would rate Graylog Enterprise a nine.

I chose nine out of ten for Graylog Enterprise because of the improvement points I raised previously. What could have made me give it a ten would be the improvements I mentioned in the room for improvement section.

Graylog Enterprise is not deployed in my organization yet. I plan to do this when I finish structuring the security area at my company, ideally in a public cloud.

My advice for others looking into using Graylog Enterprise is that regardless of how a person decides to deploy Graylog Enterprise, it will greatly help the organization in maintaining governance of the company's logs in general, not just security logs.

I use Graylog Enterprise in a SOC context, mainly for monitoring security events, log analysis, and investigations of possible incidents.

During an investigation involving Graylog Enterprise, I run queries to identify suspicious activity, analyze IP addresses and users, and correlate those logs.

I believe that Graylog Enterprise has a positive impact on my organization because, when doing this analysis, whether of an alert or of information that the client requested within their environment, we were able to bring that back to them with a lot of detail.

The access to detailed information from Graylog Enterprise had a big impact because with it we could state whether an alert was a false positive or a true positive; I would do this log correlation, and I could get an answer for the alert.

I think one of the best features that Graylog Enterprise offers is log centralization, which really makes investigation work easier; it provides the possibility of performing searches and also applying filters so you can search for specific events.

Log centralization and applying filters make my day-to-day investigations easier because when I need to investigate suspicious behavior, they help me gain agility during triage.

I think that with log centralization, you get very broad visibility of the customer's environment.

I believe that Graylog Enterprise could be improved. One of the negative points is that it could be more intuitive, especially for someone who is just starting to use it; depending on the amount of logs and the complexity of the query, the analysis may require a bit more technical knowledge.

I think the main improvement needed for Graylog Enterprise is to make some search and visualization features easier.

I used Graylog Enterprise for a period of two years, but I am not currently using it anymore.

Graylog Enterprise is stable; we used it quite proficiently.

I would say that the scalability of Graylog Enterprise is such that the more space you need, you just have to contract it, so you can have a lot of workstations in it.

I liked customer support a lot; whenever we had any difficulty, whether with log ingestion or integrating with a client, they gave us full support.

I would rate customer support a ten on a scale from one to ten because they were always very proactive with us, helping with whatever was required.

Before working with Graylog Enterprise, I worked with CrowdStrike's EDR, Falcon, and I currently work with SentinelOne, which is also an EDR solution.

Graylog Enterprise was deployed in my organization through AWS cloud.

We used AWS, from Amazon, as our cloud provider.

I believe we saw some return on investment even though I don't have access to that information, but based on what customers told us and the work we did using Graylog Enterprise, there was good customer satisfaction.

I worked more on the alert analysis side.

I would rate Graylog Enterprise an eight on a scale from one to ten.

I give that number because of the negative points I mentioned about it needing to be more intuitive, since I think someone who doesn't know it very well could have some difficulty.

Regarding the intelligence features of Graylog Enterprise, as I mentioned, I didn't use them in depth enough to have a solid evaluation, but I believe they can help speed up analyses and identify suspicious patterns.

My recommendation to others reading reviews on PeerSpot is that if you want log centralization and a SIEM, I highly recommend Graylog Enterprise.

My main use case for Graylog Enterprise is to centralize the logs from all my firewalls. It receives all my firewall logs and I have a centralized dashboard to check what is happening with my firewalls in real time. In addition, through Graylog Enterprise streams, I configure automations with Azure Logic Apps that allow me to notify several customers responsible for each firewall in real time via Teams if a given event occurs.

The biggest benefit I noticed from centralizing my firewall logs in Graylog Enterprise is that I increased my team's productivity because I monitor the internet links of my firewalls, which are all centralized. When a specific internet link goes down, a notification arrives in Graylog Enterprise and I don't need my technician to watch Graylog Enterprise's logs and contact the respective customer whose link is unavailable. Through Graylog Enterprise stream, an automation runs in the background, notifies my Logic Apps and in my Logic Apps I have another part of the flow that notifies the respective customer if their link went down via Teams and also by email.

These automations have impacted my day-to-day work positively, because they've made my team more productive. I don't depend on a technician watching Graylog Enterprise's logs and making contact. My technician is available for other, broader activities, because through Graylog Enterprise and its own integration with Azure, done through the stream connectors, I've been able to make my team more efficient. Over time, I intend to explore new features and new functionalities via stream or other sources that I've been looking for in Graylog Enterprise, so that I can automate more and more and make my team increasingly efficient.

Graylog Enterprise has had a positive impact on my organization in terms of productivity. It increased my productivity. I cannot estimate a percentage, but it has increased my productivity, because my technicians' automation actions are taken automatically through Graylog Enterprise and the stream with my Azure Logic Apps. I don't need a technician constantly checking and calling the client to inform them that their internet link went down, because Graylog Enterprise itself and Logic Apps allow me to do this automatically through Teams and email notifications. It has considerably increased my team's productivity.

Regarding the practical results of this productivity increase, there was a reduction in process time, because I have a technician free for other activities that still require a technician, and there was indeed a reduction in operational costs. Once Graylog Enterprise, integrated with Azure Logic Apps through streams, automatically sends notifications to the customer informing them that the internet link is unavailable, I don't need to hire a technician to work in my NOC. There was also a cost reduction with this implementation of automations in Graylog Enterprise.

The best features that Graylog Enterprise offers, in my opinion, are the streams that have helped me a lot, but the integration with external systems, for example Microsoft 365, ends up making my environment much more productive. Graylog Enterprise as a SIEM is fantastic for receiving logs, and the integrations with external connectors also add many features. The fact that I can filter what I specifically want from the logs that are received through the streams makes it a fantastic tool.

Regarding the filters I mentioned, they make my work easier on a daily basis, because as an IT consultant, I serve several companies that I provide services to. I have multiple clients, and these are several companies that don't communicate and have no ties between them. At these clients I have a MikroTik brand firewall which allows me customizations. I developed several automation scripts. In order not to have to access each firewall individually, I have all the logs from my firewalls sent to this centralized location which is Graylog Enterprise.

For my current needs, Graylog Enterprise has worked very well. I've been trying to specialize more and more in Graylog Enterprise, because I think it's a fantastic tool. I've been doing tests and internal training to see where Graylog Enterprise can meet other needs that I have at my company. I want to specialize more and more to make sure I can have more autonomy and productivity gains, receiving logs and automating everything that can be automated.

Graylog Enterprise is a fantastic tool, but for small and medium-sized businesses the cost ends up being high, especially in the Brazilian and Latin American market. For small and medium-sized businesses, which are a large part of the clients I serve, it still has a somewhat high cost. If there were a product line focused on small and medium business, I believe that would be the only improvement suggestion I have. If there were some Graylog Enterprise line geared toward small and medium businesses, or perhaps a SaaS service, I believe that would be interesting, but it is a fantastic tool.

I have been using Graylog Enterprise for approximately three years.

Graylog Enterprise is completely stable. I've never had any problem that would discredit it.

I haven't needed to scale Graylog Enterprise yet, because the deployment I have has been serving me very well. I haven't needed to scale so far, but I believe it will meet my needs when I expand in the future.

Customer support for Graylog Enterprise is excellent. Nothing negative to mention. When I had questions, the team was able to help me.

I haven't used a different solution before, but I've heard of Splunk, which would basically do the same thing, but due to negative comments, I never used it. I didn't try using Splunk or DataDog. I went straight to Graylog Enterprise. The fact that I could test Graylog Enterprise in an on-premises environment, virtualizing via Docker, bringing up the basic Graylog Enterprise, not the Enterprise version, to test it, was decisive for me to continue and keep using Graylog Enterprise.

I have obtained a return on investment, because I was able to reduce staff, because my process is automated. There have been financial savings as well and increased reliability, because I don't depend on a physical server hosted in my office.

Regarding my experience with pricing, setup costs, and licensing, at first, I've been using the version installed on the Linux operating system.

I evaluated other options before choosing Graylog Enterprise, including Splunk and DataDog.

My advice for others who are thinking of using Graylog Enterprise is that it's an excellent tool and will surely meet any need, because the fact that it allows customization ensures that Graylog Enterprise can meet any requirement. It is highly recommended for customers who want to use it. The fact that you can customize the data to get logs specifically from each client makes it a fantastic tool for data collection and also a fantastic tool for customizing data and sending personalized data for decision-making in third-party systems.

My primary use of Graylog Enterprise is for monitoring new functions, debugging purposes, verifying that the system is functioning as designed, and real-time tracking of operations.

A specific example of how I use Graylog Enterprise in my daily work is when our team encountered a bug in production. We had to conduct a code review to understand what was happening with the services, as the behavior was different from what was expected. We were able to structure the logs through Graylog and use its search tools to filter by production and by environment. However, Graylog alone does not solve the problem; it is necessary to structure the Graylog output so that it is useful, otherwise it will just be a massive log.

Since we started using Graylog Enterprise, I have noticed a positive impact on our organization with an improvement of approximately fifteen to twenty percent in incident response time and a decrease in rework on features that had been completed.

A specific result I have noticed since we started using Graylog Enterprise is the reduction in debugging time and bug hunting through Graylog's tools, which helped reduce bug search and resolution time by twelve to fifteen percent, which is very valuable in terms of time.

The best features that Graylog Enterprise offers in my experience are the indexing capabilities and the search and filtering functionality, as they present several innovative resources that truly help in defining parameters and understanding behavior.

When I reference the indexing and search capabilities, I notice that these features help me in my work, as I am able to see in real time what is happening with the production environment to understand why, for example, a service might fail or produce an error.

One improvement I would like to see in Graylog Enterprise would be artificial intelligence that could perform real-time analysis of logs and identify unusual behaviors or suggest changes in log structuring.

Beyond that, I have not noticed the need for further improvements to Graylog Enterprise, as it meets what I require.

I have been using Graylog Enterprise for approximately three years, totaling three years and nine months.

In my experience, Graylog Enterprise is stable.

The scalability of Graylog Enterprise is very good; it always responds to needs at the right time.

The customer support for Graylog Enterprise has always been very strong, one hundred percent, and I have no complaints.

Before using Graylog Enterprise, I used another solution that also worked with logs, such as Data Dog, but they were not very interesting and were not structured as well as I needed.

Since I began using Graylog Enterprise, I perceive a return on investment, including a fifteen percent reduction in incident response time and twenty percent less time to find bugs.

Regarding my experience with the price, configuration cost, and licensing of Graylog Enterprise, I consider that the cost-benefit ratio is very good when compared.

Before choosing Graylog Enterprise, I evaluated other options, such as Data Dog, but I realized that Graylog better met my needs at the time.

My advice for other people who are considering using Graylog Enterprise is that you will not find a tool at Graylog Enterprise's cost that meets your log and behavior inference needs, so you do not need to look much further.

Graylog Enterprise is the logging and management tool we initially used, but later we stopped using it and switched to Loki, Grafana Loki for the logs. Eventually, we moved back to Graylog Enterprise after approximately one year.

The main use case for Graylog Enterprise is that we primarily use it for our enterprise logs. We have around 11 services, so we use it to collect all of our logs in one location. We use it for both QA and production environments.

A specific example of how we use Graylog Enterprise in our environment is that we have multiple logins for our MDM solution, a mobile device management solution. Since it is an enterprise application, we generally use Graylog to retrieve the logs and determine if there is an error or any downtime. Graylog Enterprise has been very helpful in identifying issues and is also extremely valuable for handling high-volume log throughput. The cost-effectiveness of Graylog Enterprise has been particularly beneficial to us.

The standout features that make Graylog Enterprise valuable for my team are particularly helpful for Site Reliability Engineers, IT, and DevOps security, as it delivers excellent functionality without extreme cost. Its alerting system and notification capabilities really help us, as we use Slack to receive alerts from Graylog Enterprise. Additionally, the data management and the pipeline to transform and categorize the logs as they flow in are valuable. The best feature of Graylog Enterprise is its high-performance search engine that provides fast, flexible, and scalable analysis of machine data or pod data.

When there is any error, bug, or downtime, Graylog Enterprise sends us an alert to Slack, so we can immediately investigate and find what the issue is, whether it is with the pipeline or within a service. We can determine exactly what happened and why it is causing the downtime. If we need to spin up more pods or if it needs more memory or CPU usage, we take the appropriate initiative based on that assessment.

Graylog Enterprise has positively impacted my organization by significantly minimizing our workload and making it easier to identify any issues in a service. It features good custom dashboards, visualization, and good search capability as well.

I do not have any specific examples or numbers, such as time saved or incidents to share. Currently, I have no suggestions for how Graylog Enterprise can be improved, as there are no pain points or features I wish were better.

I have been working in my current field for around 2.3 years.

Graylog Enterprise is cost-effective, but when compared with Elasticsearch, it can be more costly. I chose a rating of nine out of ten because there is not much that I would change to make it a perfect ten for me. I suggest using Graylog Enterprise, as it really helps to maintain and use everything effectively, ensuring the sustainability and health of the pods. My overall review rating for Graylog Enterprise is nine out of ten.