Compare / Graylog vs Grafana Loki
Graylog vs Grafana Loki
Pick Grafana Loki if you want AGPL-3.0 Prometheus-shaped logs next to Grafana OSS. Pick Graylog if you want that SSPL-1.0 log box and accept it is not OSI. The published Loggly / Splunk / Papertrail cluster remains OpenSearch — /stacks/opensearch.
Facts checked 26 Oct 2026. License, language, and GitHub activity come from the catalog or the project's own repo. "Not in the catalog row" means the public catalog dump does not store that number.
Graylog in the catalog Grafana Loki in the catalog Start on Railway
How they compare
| Graylog | Grafana Loki | |
|---|---|---|
| License | SSPL-1.0 (not OSI) source | GNU Affero General Public License v3.0 (catalog) source |
| Language | Java (catalog) | Go (catalog) |
| GitHub activity | 8,164 stars in the catalog; last push 26 Oct 2026 source | 29,055 stars in the catalog; last push 26 Oct 2026 source |
| Self-host | Official docs at graylog.org. JVM log box. | Prometheus-shaped logs. Pairs with Grafana OSS on /stacks/grafana-observability. |
| Best for | A source-available log box if you accept SSPL. | AGPL logs next to Grafana if OpenSearch is not the shape. |
Self-hosting and resource needs
OpenSearch is the published lander — /stacks/opensearch. Loki is grafana/loki. Graylog is Graylog2/graylog2-server (SSPL-1.0). Dozzle is a container tail, not this pair. SigNoz is APM — /compare/signoz-vs-loki. Neither Graylog nor Loki has a one-click c17 Railway template.
FAQ
- Loggly or Papertrail?
- Same published log index — /replace/loggly and /replace/papertrail. OpenSearch is the published cluster.
- Why not Elasticsearch?
- Recent Elasticsearch is SSPL / Elastic License. OpenSearch is Apache-2.0 — /stacks/opensearch.
- Are these free?
- Loki is AGPL-3.0. Graylog is SSPL-1.0, not OSI. You pay hosting and disk.
- How do I deploy OpenSearch?
- Open /stacks/opensearch. Persist data. Point one client at the new URL.
Related pages
Stack of the Week
Get one stack a week that replaces a SaaS bill.