Graylog Room for Improvement

Mark Walters
Release Engineering Manager
The collectors and using sidecar made my life easier from earlier versions. Unfortunately, I have been pulled away from the product, beyond setting up new inputs, defining the alerts. I am currently trying to leverage the API and Graylog Extended Log Format (GELF), and some of the underlying tech of Elasticsearch as well, for downstream consumers and our AI consumers. For improvements or features to add, I would like to see a default dashboard widget that shows the topology of the clusters defined for the graylog install. For instance, I have three Elasticsearch nodes and three MongoDB. I would like to see a visual representation of their status. Additionally, maybe it does exist (I have not looked), but I would like to see percent filled of the current index. View full review »
Systémový inženýr DS senior
The biggest problem is the collector application, as we wanted to avoid using Graylog Collector Sidecar due to its architecture. It requires connection outside our network during build from source, so we decided instead to use the obsolete Graylog Collector, which is working fine and in an easy way. It would be great, if that component would get back into the development process. But it is nothing that I could even complain about, as our company is not paying for support. View full review »
Senior Architect at a tech vendor with 51-200 employees
Elasticsearch recommendations for tuning could be better. Graylog doesn't have direct support for running the system inside of Kubernetes, so it can be challenging to fill in the gaps and set up containers in a way that is both performant and stable. We ran into problems with Elasticsearch throwing a circuit-breaking exception due to field data size being too large. It turned out that the heap size directly impacted this size in a high-throughput environment, causing unexplained instability in Graylog. We were able to troubleshoot on the Elasticsearch size, but we should have been able to reference some minimum requirements for Graylog to know that our settings weren't sufficient. Otherwise, the documentation is great and there are a lot of options for configuration. Since container orchestration systems are popular and Graylog fits the niche well, perhaps they could officially support running in docker containers on Kubernetes as a StatefulSet as a use case. That way, the declarative nature of Kubernetes config files would document their best-case deployment scenario. View full review »
John Paul Dienst
Technology Consultant
* Backup and restore functionally for migrating instances. * Dashboard and search analytics (i.e., more complex visualizations and the ability to execute custom Elasticsearch queries would be great). * More flexible alert conditions View full review »
IT Security Consultant at a tech services company with 10,001+ employees
There are places which could be improved: * Stream alerts * Dashboards * Parsing. Some places were already improved in 2.4 with the threat intelligence add-on. View full review »
Oskars Pakers
Java Software Developer at a financial services firm with 5,001-10,000 employees
The alerting system could be more flexible. It does not allow for definition of different thresholds and alert types of the same streams. It allows different alert types and thresholds for the same stream. E.g., if we have a single stream of errors, I would like to send each error to the ticketing system: A mail if there are less than 1 errors per second and an SMS if greater than 10 errors received per second. View full review »
Software Engineer, DevOps at a tech services company with 51-200 employees
There should be some user groups and an auto sign-in feature. View full review »

Sign Up with Email