It starts with index-on-write and organizing of data with pipelines and streams to ensure the data is already well structured and searches can be limited to only the relevant data set.
The design of Graylog’s data storage and retrieval architecture inherently allows for multi-threaded and distributed search across the environment. Each search uses multiple processors and multiple buffers, then multiplies that threaded search across the number of participating nodes in the cluster. This approach gives much faster results, which allows the analyst to work through the dataset without having to schedule, save, or “walk away” from a search to continue at a later time.
Unlike competing products, there’s no need to learn a custom query language or submit pages of queries to an API to find the data you are looking for. Simply select the fields you want returned, use standard boolean operators to create your search, and specify how you want the data returned: raw data, aggregated data, count, or chart.
If you want to run this search on a regular basis, simply save it and easily share it with teammates. If you see something you want to continuously monitor in your results, or you want reports on these results delivered to your inbox on a regular basis, quickly build dashboards and reports with just a click or two right from the search results.
Enterprise users can build and combine multiple searches into a Search Workflow and review the delivered results on one screen.
