ArcSight Logger vs Graylog comparison

"Our return on investment for implementing ArcSight Logger over the past 12 months has been positive."

"The solution provides information about the risk factors."

"The most valuable feature is the level of detail that you can see about certain events, even when they do not come up in the console."

"It is one of the best products available in the market."

"In our country we are a little bit private in terms of solutions, so we are just starting to use the basic data capture. Now some users can start to use additional features that come with Micro Focus ArcSight like user behavior analytics for investigating."

"The most valuable feature is the search capability, which is simple to use."

"I am impressed with the product's ability to pick up logs. It also has UEBA which has reduced the time to take charge of the events."

"The technical support team is good...It is a scalable solution."

"Everything stands out as valuable, including the fact that I can quantify and qualify the logs, create pipelines and process the logs in any way I like, and create charts or data maps."

"We run a containerized microservices environment. Being able to set up streams and search for errors and anomalies across hundreds of containers is why a log aggregation platform like Graylog is valuable to us."

"Open source and user friendly."

"Graylog's search functionality, alerting functionality, user management, and dashboards are useful."

"Real-time UDP/GELF logging and full text-based searching."

"What I like about Graylog is that it's real-time and you have access to the raw data. So, you ingest it, and you have access to every message and every data item you ingest. You can then build analytics on top of that. You can look at the raw data, and you can do some volumetric estimations, such as how big traffic you have, how many messages of data of a type you have, etc."

"We have scaled from a single machine installation (a VM with a Graylog + ES + MongoDB) to (2 Graylog + 2 ES + 3 MongoDB). This was done smoothly with a minimal impact on logging."

"The best feature of Graylog is the Elasticsearch integration. We can integrate and we can run filters, such as an event of interest, and those logs we can send to any SIEM tool or as an analytic. Additionally, there are clear and well-documented implementation instructions on their website to follow if needed."

"The solution must provide readymade connectors for different applications."

"The integration with other systems could be improved."

"We have had problems with archiving."

"It's not a new product and is a bit complex. So, it requires a person dedicated to working on it and to know about it in and out. It is a huge product, and the search operation is a bit complicated for a new user or someone who has not used it for long. So for that person, it becomes a bit difficult."

"The solution could be improved in maintenance settings."

"We find that the search and access functionality is quite slow."

"It would be better if the product is cheaper."

"The platform is quite expensive. They should reduce its cost."

"Since container orchestration systems are popular and Graylog fits the niche well, perhaps they could officially support running in docker containers on Kubernetes as a StatefulSet as a use case. That way, the declarative nature of Kubernetes config files would document their best case deployment scenario-"

"We ran into problems with Elasticsearch throwing a circuit-breaking exception due to field data size being too large. It turned out that the heap size directly impacted this size in a high-throughput environment, causing unexplained instability in Graylog. We were able to troubleshoot on the Elasticsearch size, but we should have been able to reference some minimum requirements for Graylog to know that our settings weren't sufficient."

"Graylog needs to improve their authentication. Also, the fact that Graylog displays logs from the top down is just ridiculous."

"More customization is always useful."

"I would like to see a default dashboard widget that shows the topology of the clusters defined for the graylog install."

"I would like to see some kind of visualization included in Graylog."

"I hope to see improvements in Graylog for more interactivity, user-friendliness, and creating alerts. The initial setup is complex."

"Graylog could improve the process of creating rules. We have to create them manually by doing parses and applying them. Other SIEM solutions have basic rules and you can create and get more events of interest."

"I would rate the product a seven out of ten since it's an enterprise product."

"Pricing is reasonable compared to similar tools on the market. They offer perpetual licenses."

"ArcSight Logger is very expensive compared to their competitors, but when we talk to the customer and explain what the features are and how we can scale, they understand. Still, ArcSight is more expensive than the competition."

"ArcSight is an expensive solution."

"I rate the product’s pricing a seven out of ten, where one is inexpensive, and ten is expensive."

"It's not cheap at all as it's a big product and has been in the market for quite some time now."

"The pricing is quite harsh."

"We have a lifetime license, so we don't pay a monthly fee."

"We are using the free version of the product. However, the paid version is expensive."

"Having paid official support is wise for projects."

"​You get a lot out-of-the-box with the non-enterprise version, so give it a try first."

"I am using a community edition. I have not looked at the enterprise offering from Graylog."

"There is an open source version and an enterprise version. I wouldn't recommend the enterprise version, but as an open source solution, it is solid and works really well."

"I use the free version of Graylog."

"If you want something that works and do not have the money for Splunk or QRadar, take Graylog.​​"

"It's an open-source solution that can be used free of charge."