Graylog: Centralized Log Management

By Kokil Thapa | Last reviewed: September 2026

Graylog: Centralized Log Management solves a problem every production team hits eventually: logs scattered across Apache access files, PHP-FPM journals, Laravel storage/logs, and cron output. You cannot debug a failed payment callback or a slow query at 2 a.m. when you are SSH-ing into three servers with grep. Graylog collects those streams into one searchable index with dashboards, alerts, and role-based access. If you already run Ubuntu servers for Linux system administration workloads, Graylog fits naturally beside your existing stack.

What is Graylog and how does centralized log management work?

Graylog is an open-source log management platform. It accepts logs over syslog, GELF, Beats, and HTTP. It normalizes fields, applies extractors or pipelines, and writes searchable documents to OpenSearch (or legacy Elasticsearch). Configuration, users, dashboards, and stream rules live in MongoDB.

The mental model is simple. Producers emit events. Graylog ingests and enriches them. Operators query and alert. That separation mirrors what I describe in observability vs monitoring: logs answer "what happened," while metrics and traces answer "how fast" and "where in the call chain."

On a production Laravel application, I typically ship three layers: web server access logs, PHP application logs, and queue worker output. Payment gateways like eSewa or Khalti generate callback logs that must survive rotation. Centralizing them prevents the "it worked in staging" blind spot after deploy.

Graylog differs from tailing files on each box. It adds structured fields (source, facility, http_status, user_id), full-text search, and correlation across hosts. For legal-tech portals with document uploads and audit trails, that audit visibility pairs well with application-level logging patterns described in Laravel activity log with Spatie.

Core components you must plan for

• Graylog server — JVM process handling ingestion, processing, and API.
• OpenSearch — stores log messages; size this for retention, not peak RAM on the Graylog node.
• MongoDB — stores Graylog configuration; a single-node instance suffices for many small teams.
• Log shippers — Filebeat, Fluent Bit, or rsyslog on each application server.

Budget a dedicated VM or a separate disk group. Co-locating Graylog and your primary MySQL on one Rs 5,000/month (~USD 37) VPS is a common Nepal hosting mistake. Log spikes during traffic events will starve the database.

How do you install Graylog on Ubuntu for production logging?

Graylog publishes official packages for Ubuntu 22.04 and 24.04. Match your OpenSearch major version to Graylog's compatibility matrix on Graylog's installation documentation. The steps below assume a dedicated logging host with OpenSearch 2.x and MongoDB 7.x.

Prepare OpenSearch and MongoDB

1. Install OpenSearch with a dedicated data path on fast SSD storage.
2. Install MongoDB and bind it to localhost only.
3. Set vm.max_map_count and file descriptor limits before starting OpenSearch.
4. Install Graylog from the official repository and set password_secret and root_password_sha2.

Generate the root password hash:

echo -n "YourStrongPassword" | sha256sum
openssl rand -hex 64

Edit /etc/graylog/server/server.conf:

password_secret = PASTE_64_CHAR_HEX_HERE
root_password_sha2 = PASTE_SHA256_HASH_HERE
http_bind_address = 0.0.0.0:9000
elasticsearch_hosts = http://127.0.0.1:9200
mongodb_uri = mongodb://127.0.0.1:27017/graylog

Enable and start services:

sudo systemctl enable opensearch mongod graylog-server
sudo systemctl start opensearch mongod graylog-server
sudo systemctl status graylog-server

Open port 9000 only through your firewall or VPN. For teams already managing servers, this fits alongside practices in log rotation and disk space management on Linux. Graylog reduces SSH log hunting but does not replace rotation on source hosts.

Post-install checklist

• Confirm OpenSearch cluster health is green or yellow.
• Log in at https://logs.example.com:9000 with user admin.
• Create an index set with realistic retention (see below).
• Create inputs before pointing shippers — otherwise events buffer and drop.

If Graylog fails to start, check Java heap settings in /etc/default/graylog-server. A 4 GB heap on an 8 GB VM is a sensible starting point for small deployments.

Which inputs and extractors should you configure first?

Inputs define how Graylog receives data. For PHP and Laravel stacks on Ubuntu with Apache, I configure these four first.

1. Beats input for Apache and Laravel files

Create a Beats input on port 5044. Install Filebeat on each app server:

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/apache2/access.log
      - /var/log/apache2/error.log
      - /var/www/app/storage/logs/laravel.log
    fields:
      env: production
      app: booking-portal
    fields_under_root: true

output.logstash:
  hosts: ["logs.example.com:5044"]

Point Filebeat at Graylog's Beats input directly if you are not using Logstash. Graylog accepts Beats natively.

2. GELF UDP/TCP for structured Laravel logs

Monolog's GELF handler sends JSON with custom fields. That beats regex-parsing stack traces from plain text.

use Monolog\Handler\GelfHandler;
use Monolog\Logger;
use Gelf\Publisher;
use Gelf\Transport\UdpTransport;

$transport = new UdpTransport('logs.example.com', 12201);
$publisher = new Publisher($transport);
$handler = new GelfHandler($publisher, Logger::DEBUG);

Create a GELF UDP input in Graylog on port 12201. Add fields like request_id, user_id, and gateway in your logging context. Payment debugging becomes a single query: gateway:esewa AND level:3.

3. Syslog for system and PHP-FPM messages

Forward rsyslog from app servers:

*.* @@logs.example.com:514

Map PHP-FPM slow logs and systemd unit failures into a "Infrastructure" stream. This catches deploy issues that never reach Laravel's log channel.

4. Streams, pipelines, and alerts

Streams route messages by rules — for example, source must match app-server-01 AND message must contain ERROR. Attach alerts to streams: more than 50 errors in five minutes emails the on-call developer.

Use pipelines for grok parsing Apache combined logs into http_method, url, and status_code. Test pipeline rules against sample messages in the UI before applying them globally. Validate JSON payloads with a JSON formatter when building pipeline rules from API responses.

For background on shippers, see Fluentd vs Fluent Bit for log shipping. Fluent Bit is lighter than Filebeat on very small VPS instances.

How does Graylog compare to the ELK stack and Grafana Loki?

Teams often evaluate Graylog against Elasticsearch-Logstash-Kibana (ELK) and Grafana Loki. All three centralize logs. The operational cost and query model differ sharply.

My practical verdict: choose Graylog when you want centralized search and alerting without assembling four Elastic components yourself. Choose ELK when you already employ Elasticsearch for search analytics and have staff to maintain it — see centralized logging with the ELK stack for that path. Choose Loki when your workloads live in Kubernetes and you already run Grafana — covered in log aggregation with Loki and Grafana.

For multi-service setups spanning API gateways and workers, read multi-cloud observability metrics logs traces. Logs are one leg of the stool. Graylog does not replace APM or uptime checks.

How do you secure Graylog and manage retention on a budget?

Security and disk costs determine whether centralized logging survives past the first month. An open Graylog port on the public internet gets scraped within hours.

Network and authentication hardening

• Place Graylog behind a VPN or restrict port 9000 to admin IP ranges with UFW.
• Terminate TLS at Nginx or Caddy in front of Graylog's web interface.
• Create role-based users: developers search production; clients get no access.
• Never expose MongoDB or OpenSearch ports publicly.
• Rotate the root password and store secrets in your existing vault workflow — see CI/CD secrets management best practices.

Graylog supports LDAP and SAML in enterprise builds. For a five-person agency, local users with strong passwords and MFA on the VPN endpoint is enough.

Retention, index sets, and disk math

Index sets control rotation and deletion. A typical policy for a booking platform:

• Production app logs — 30 days online, then delete.
• Security / auth logs — 90 days online, archive to S3-compatible storage if required.
• Debug streams — 7 days only.

OpenSearch stores inverted indexes. Text-heavy Laravel stack traces consume more disk than Apache access lines. Monitor index size weekly. If daily ingest exceeds 5 GB, add data nodes or shorten retention before the disk fills.

Configure index rotation by size (for example, 5 GB per index) and max number of indices. Graylog's maintenance alerts warn when disk usage crosses thresholds. Pair this with host-level monitoring from support and maintenance contracts so someone acts on alerts.

Laravel production logging without leaking secrets

Centralizing logs increases blast radius if you log PAN numbers, API keys, or session tokens. Scrub payloads in Monolog processors before GELF export. Disable debug logging in production entirely — use debug Laravel in production safely as your reference for what belongs in centralized logs vs local Telescope sessions.

On projects like Adventure Third Pole Trek, queue worker logs and Livewire errors share the same Graylog stream as HTTP traffic. Correlating by request_id cut mean-time-to-recovery during payment and booking incidents.

When Graylog is overkill

If you run one small WordPress site with low traffic, structured journalctl grep plus rotation may suffice — see log parsing and alerting with awk and journalctl. Graylog earns its RAM when you have two or more app servers, background workers, or compliance requirements for searchable audit history. Legal client portals such as Mijar Law Associates benefit from provable log retention even at modest scale.

How do you integrate Graylog into a Laravel deployment pipeline?

Treat logging infrastructure like any production dependency. Provision the Graylog VM with Terraform or Ansible alongside app servers. Document the GELF hostname in your deploy checklist.

After each Deployer symlink swap, verify three signals in Graylog: fresh Apache access lines, Laravel info boot messages, and queue worker heartbeat logs. Missing worker logs after deploy often means a stale systemd unit path — a failure mode I have seen on shared EC2 hosts running Deployer 7.

For enterprise applications with separate staging and production, create distinct streams filtered by a custom env field. Never ship staging noise into production alert rules. Teams building custom platforms can align logging architecture during enterprise application development discovery rather than retrofitting later.

Performance testing should include log volume estimates. A load test that doubles request rate also doubles ingest. Factor that into testing and optimization plans before launch week.

Small teams without dedicated ops staff should read log aggregation for small teams practical setup before committing hardware. Start with one week of Filebeat shipping to a trial Graylog instance. Measure daily gigabytes, then size OpenSearch disks with a 40% headroom buffer.

Key Takeaways

• Graylog: Centralized Log Management combines ingestion, OpenSearch storage, MongoDB config, and built-in alerts in one UI suited to VM-based PHP/Laravel stacks.
• Install Graylog on a dedicated Ubuntu host with OpenSearch and MongoDB; never share disk with your primary database.
• Ship Laravel logs via GELF with structured fields; use Filebeat for Apache and system logs; create streams before enabling alerts.
• Set index retention by log class (7–90 days) and monitor disk weekly — text stack traces consume index space fast.
• Compared to ELK and Loki, Graylog hits the sweet spot for small teams that need full-text search without a platform engineering team.
• Scrub secrets before centralizing; restrict port 9000; correlate deploys by checking worker and web logs immediately after release.

People Also Ask

Does Graylog require Elasticsearch?

Modern Graylog versions use OpenSearch as the default backend. OpenSearch is a fork compatible with Elasticsearch APIs. Check Graylog's current compatibility matrix before upgrading either component. MongoDB remains required for Graylog's own configuration and is documented in the MongoDB installation manual.

How much disk space does Graylog need?

Plan for roughly three to five times your daily raw log volume in OpenSearch storage, depending on field cardinality and retention. A site generating 2 GB/day of combined web and app logs with 30-day retention typically needs 120–180 GB plus headroom. Shorten retention or drop verbose debug streams first before buying larger disks.

Can Graylog receive logs from cloud APIs and webhooks?

Yes. Graylog supports HTTP inputs and JSON parsing pipelines. You can forward webhook payloads from payment gateways or third-party services into dedicated streams. Validate JSON bodies during pipeline development and alert on HTTP 4xx/5xx patterns in your application logs rather than logging full callback secrets.

Is Graylog free for commercial use?

The open-source Graylog server is free to deploy and use commercially. Enterprise plugins add compliance, archiving, and advanced authentication features. Most Nepal agencies and SMBs run the open-source edition on a dedicated VPS without needing enterprise licensing.

Ship searchable logs before the next production incident

Graylog: Centralized Log Management turns scattered file tails into one queryable system. You gain faster payment debugging, deploy verification, and audit trails without hiring a platform team. Start small: one logging VM, one Beats input, one GELF channel from Laravel, and a single error-rate alert. Expand streams as log volume proves value.

If you want help sizing infrastructure, wiring Monolog to GELF, or folding centralized logging into a Laravel or legal-tech deployment, contact us for a practical architecture review. You can also browse the portfolio for examples of production systems that depend on reliable operational visibility, or explore related guides on the blog including web development services for full-stack delivery.