Graylog licenses processed data volume in the active data tier. Two models are available: daily volume (capacity), measured in gigabytes per day, and annual consumption, measured in Graylog Consumption Units (GCUs). Entry points are 10 GB per day and 100 GCUs. Device count, user count, and total stored data do not affect licensing.

Daily volume (capacity) licenses a per-day processing rate, starting at 10 GB per day. Annual consumption licenses an estimated yearly total, starting at 100 GCUs, drawn down as data is processed. Daily volume is best for those with predicatable and consistent log volume. Consumption is best for those with unpredictable log volume and environments that experience heavy variation due to seasonality or other factors.

A GCU is a Graylog Consumption Unit. Consumption-based subscriptions have a fixed annual platform subscription fee and a variable amount of Graylog Consumption Units. A single GCU can be redeemed for 20 GB of Graylog Security or 25 GB of Graylog Enterprise. GCU’s are typically purchased in bundles and volume discounts apply. The closest analogy is a pre-paid gift card.

Graylog licenses processed data, not collected data. There is no restriction on the number of sources that can be connected. Pipeline rules and data lake routing determine which of that data is processed, and only processed data in the active data tier counts toward the license.

Graylog licenses are annual subscription. Published starting prices are annual figures, not monthly.

Volume discounts are built into the pricing structure. The per-unit rate decreases at each licensing tier.

One to five year subscription terms are available. Multi-year terms lock in prices, eliminating the need to negotiate annually and preventing price increases during the term. Term length does not change licensed volume, unless the contract is structured as a ramped volume.

Yes, work with your Customer Success Manager.

Yes. Pipeline rules can trim fields or discard events before processing, so they do not count toward the license. Data can also be routed to the data lake instead of being processed. Neither requires disconnecting a source.

Yes. Enrichment adds fields to messages, which increases message size and therefore processed volume. Enrichment can be applied selectively rather than to all data.

Data routed to the data lake does not count toward the license while it remains there. To use it, you include the data lake in a search, review the results, and select what data to retrieve. Retrieved data counts toward daily volume or annual consumption at that point.

Data required for dashboards, scheduled reports, or alerting rules. Those functions operate on processed data and evaluate continuously. The data lake is for data retained in case it is needed later.

For self-managed customers, archive data was processed and counted at ingest, so retrieval carries no additional license cost. This differs from the data lake, where data is routed in before processing and counts when retrieved. For Cloud customers, it depends on the retention terms in your contract. The default is 90 days of live data and 1 year of retention for Graylog Cloud.

Yes. All tiers are fully searchable. Hot and warm are included in searches by default. The data lake and Archive must be explicitly included in a search.

For self-managed customers, you do. Retention length does not affect licensing. It affects storage cost, which varies by tier across hot, warm, and archive.

For Graylog Cloud customers, it is negotiated in your contract.

Both are licensed on the same foundational platform. Enterprise provides log management: collection, search, data tiering, reporting, and access control. Security includes everything in Enterprise and adds SIEM capabilities: maintained detection content, anomaly detection, guided investigations, risk scoring, and more.

Graylog Open is free permanently. It is not a trial. There is no daily ingest cap and no volume limit of any kind. It is source-available under the Server Side Public License (SSPL) and has a narrower feature set than the paid licenses.

Yes. Applying a license key upgrades the existing installation. No migration, reinstall, or data movement is required. Configuration, dashboards, and historical data are unchanged. However, we often find this a good time to perform an architecture review, optimize your configurations, and move up to the most current version. Some customers find a clean install with a data migration is the better choice. We will guide you through this and provide you assistance as part of the onboarding process.

Graylog Accelerator, the guided onboarding service, is included with every paid license. On-demand training is free and available to anyone. Live training, custom training, Professional Services, and Technical Account Management are paid add-ons available to licensed customers.

A Graylog representative will contact you to schedule a scoping call to review your environment and requirements. These calls are typically about 20 minutes.