Graylog Hosting in Germany
We install and operate Graylog on your infrastructure - including inputs, pipelines, search, retention, alerts, dashboards, updates and recovery with an assessed edition.
About the technology
Control log data from source to response
Graylog brings together system, application and network logs. Without a source inventory, parsing, timestamps, retention and defined alert rules, central collection quickly becomes expensive storage with little dependable value.
We install and operate Graylog on your infrastructure, connect inputs and sources and design pipelines, index lifecycles, dashboards, alerts and backups. Security and compliance requirements are scoped for each data source.
Graylog for central logs and technical events
Central inputs
Collect syslog, GELF and other supported sources through controlled endpoints.Parsing and pipelines
Normalise, enrich and filter fields and route data into suitable streams.Search and streams
Separate logs by system, environment, tenant or area of responsibility.Dashboards and alerts
Expose technical patterns and alert on relevant events.Retention and archives
Design index lifecycles and retention around value, cost and policy.Sources and integrations
Connect servers, applications, firewalls, cloud services and ticketing.Migration and takeover
Assess existing data and configuration, migrate them in a test run and move to managed operations through a controlled cutover.Identity and secure access
Secure SSO, roles, administrative paths and external access for the application and existing infrastructure.Backup and recovery
Back up all stateful components consistently and document the recovery path for the agreed scope.Updates, monitoring and operations
Monitor and update the application and its technical dependencies and operate them under the agreed service level.
Operations beyond installation
Operate Graylog as a resilient logging pipeline
Transport, processing, search, retention and alerting are monitored together so missing or delayed logs are visible.
Log sources
Control inputs, transport, buffering and timestamps.Streams and indices
Structure parsing, routing, search and lifecycle.Access and retention
Implement roles, data classes and retention technically.Platform operations
Own updates, monitoring, backup and capacity.
Area
Ownership of platform and log content
WZ-IT operates the technical pipeline; sources, data classification and binding retention are agreed with the customer.
| Area | Responsibility | Scope and boundaries |
|---|---|---|
| Graylog and foundation services | WZ-IT | Installation, configuration, hardening, updates and monitoring. |
| Index lifecycle and capacity | WZ-IT | Technical retention, shards, storage and health control. |
| Inputs and pipelines | Shared | WZ-IT implements; the customer confirms sources, fields and routing. |
| Alerts and runbooks | Shared | Technical rules and desired response are defined together. |
| Data classification and periods | Customer | Business and legal policies come from the organisation. |
| SIEM and compliance expansion | Optional WZ-IT service | Correlation, reports and security processes are designed separately. |
Hosting & operations
How much does Graylog hosting cost?
We combine the right compute size with ongoing operations, backups, monitoring and a service level appropriate for the criticality of Graylog. High availability and recovery targets are designed separately where needed.
Hosting for Graylog in Germany: GDPR-compliant operations
- One managed standard application included
- Subdomain on wz-it.cloud included
- German data centres with ISO 27001 and BSI C5, no US clouds
- 99.9 % standard availability per month
- Regular updates, CVE monitoring and prioritised patches for critical vulnerabilities
- Central logs with immutable retention
- Daily backup with 7-day retention
- 5 TB outbound traffic per workload and month
- 24/7 proactive monitoring
- Five service levels, 24/7 P1 response with Production or Critical
- Personal technical contact
Instance sizes and monthly prices
- XS · 2 vCPU, 2 GB RAM, 40 GB NVMe SSD
- €99.90 in total
- S · 2 vCPU, 4 GB RAM, 80 GB NVMe SSD
- €129.90 in total
- M · 4 vCPU, 8 GB RAM, 80 GB NVMe SSD
- €159.80 in total
- L · 8 vCPU, 16 GB RAM, 80 GB NVMe SSD
- €219.80 in total
- XL · 16 vCPU, 32 GB RAM, 80 GB NVMe SSD
- €329.80 in total
- Additional storage per 50 GB
- +€4.99
All prices are net and exclude statutory VAT. The offers are addressed to businesses. All on-premises options
Other options
Try it free for 7 daysRequest a test instance
We set up a test instance for you, usually on the next business day. No payment details required. After seven days it is deleted unless you continue.
Request a test instance →Bring Your Own InfrastructureInstallation on Your Infrastructure
Installation on your own infrastructure · On-premise or in your cloud · Control over data location and access · Custom configuration · Complete documentation · Initial setup & configuration · Optional support and maintenance contract
Request a proposal →On-premises optionRun Graylog on hardware at your organisation
As an alternative to managed hosting in the data centre, WZ-IT provides the hardware, configures Graylog, and handles hardening, monitoring, updates, backup and technical support. Access can be limited to the internal network or enabled through VPN and existing identities.
View WZ-IT App Node →Sizing and deployment
Size Graylog around ingest, search load and retention
Logs per second, daily volume, parsing cost, search window, replication and retention determine platform and cost.
| Usage scenario | Technical starting point | Key factors |
|---|---|---|
| Small central log view | Compact single environment | Few sources, short retention and normal search. |
| Production server and application logs | Separate Graylog and data services | Buffering, maintenance and storage are decoupled. |
| High ingest or long retention | Log assessment | EPS, GB per day, fields and search profile are measured. |
| Security or compliance use | Platform assessment | Edition, audit, archive, HA and response processes are clarified. |
- A proposal requires at least source count, daily log volume, retention, search profile, edition and desired incident response.
Sizing and deployment
Graylog on your infrastructure
Log data remains in your controlled environment; WZ-IT receives defined administrative access for operations.
Your cloud account
Central log platform inside your cloud and network boundaries.On-premise
Collect logs from internal servers, networks and applications locally.Dedicated servers
Predictable storage and I/O for continuous ingest.Hybrid
Collector and relay paths across clouds and sites.
Target architecture
Decouple log transport, processing and search
Sources send over defined and preferably buffered paths; Graylog processes and routes data into controlled index areas.
Operations, development and security
Search, dashboards, alerts and approved exports.
TLS and private access
Protected inputs, web access and restricted administration.
Roles and data domains
Access by team, stream, data class and edition.
Graylog
Inputs, pipelines, streams, search, dashboards and alerts.
Transport and buffer
Sources, sidecars or brokers stabilise log flow.
Search and index storage
Data storage, lifecycle, replication and capacity.
Monitoring and recovery
Ingest gaps, journal, index health, alerts and backups.
Graylog backups must account consistently for application configuration and underlying data services. Restore is documented for the exact version and topology.
Role in the overall system
Related services for Graylog
This page covers installation and the agreed platform operations for Graylog. Custom code, the access layer and special confidentiality requirements remain clearly separated responsibilities that can be added when needed.
Support custom code and integrations
Keep custom extensions, interfaces and dependencies controlled, updated and supportable.
View service Secure accessConnect users, sites and systems
Add identity-based access and private network paths as a separate operational layer.
View service Operate confidentiallyAssess Section 203 requirements separately
For professional secrecy holders, define contractual, access and infrastructure requirements in a dedicated operating model.
View serviceThree relevant adjacent paths instead of a long list of further products.
View the overall systemFrequently asked questions about Graylog operations
Answers about editions, log volume, retention, alerting and takeovers.
- Graylog hosting with WZ-IT starts at €99.90 net per month. It includes a dedicated size XS instance (2 vCPU, 2 GB RAM, 40 GB NVMe SSD), updates, daily backups with 7 days of retention, 24/7 monitoring, 5 TB of outbound traffic and a first response to critical incidents by the end of the next business day. Larger instances and higher service levels cost extra; the configurator shows the total price.
- The entry level is a dedicated size XS instance with 2 vCPU, 2 GB RAM, 40 GB NVMe SSD for €99.90; it suits lightweight applications as well as test and development environments. Size S with 2 vCPU, 4 GB RAM, 80 GB NVMe SSD costs €129.90. We check which size Graylog needs in production before provisioning. Size M (4 vCPU, 8 GB RAM, 80 GB NVMe SSD) costs an extra €29.90 excl. VAT, L (8 vCPU, 16 GB RAM, 80 GB NVMe SSD) an extra €89.90 excl. VAT and XL (16 vCPU, 32 GB RAM, 80 GB NVMe SSD) an extra €199.90 excl. VAT, each per month. Additional storage costs €4.99 excl. VAT per 50 GB and month.
- No. WZ-IT does not limit the number of users. How many users can work smoothly at the same time depends on usage and the chosen instance size XS to XL.
- Graylog hosting can be cancelled monthly, with no minimum term and 30 days' notice to the end of the month.
- In German data centres operated by a German provider, without US clouds. The data centres are ISO 27001 certified and BSI C5 attested.
- We provide a production instance within a few business days. For a trial, we set up a test instance, usually on the next business day; it runs free of charge for 7 days and without payment details.
- Yes. A subdomain on wz-it.cloud is always included. You can connect your own domain with a CNAME record.
- On your cloud or on-premise infrastructure for your internal use. Edition and licence are assessed before build or takeover.
- Yes. We inventory inputs, formats, pipelines, streams, dashboards, alerts and retention and migrate them through a controlled parallel or test phase.
- That depends on daily raw volume, field structure, replication, search window and retention. We measure or estimate these values before sizing.
- Central logs and alerts are a foundation. Correlation, use cases, incident process, threat intelligence and compliance evidence require a security design and potentially an appropriate edition.
- That is available with a suitable service level. Alert rules, priorities, runbooks and responsibilities are documented first.
Knowledge
More about Graylog
Matching solutions for your project
- GrafanaPlatform for data analysis and visualization
- ntfyHTTP-based push service for notifications from monitoring, automation and applications
- PostgreSQLAdvanced open-source object-relational database system
- OpenSearchOpen-source enterprise search & analytics engine without vendor lock-in
- WazuhOpen-source security platform for threat detection, compliance monitoring, and incident response
- PrometheusSystem for monitoring and alerting
Reviews & projects
Client feedback and projects worldwide
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
- Secure your Proxmox & backup setup
- Modernize your infrastructure - sovereign
- Plan a sovereign open-source stack
- Integrate a local AI solution
- Modernize your legacy software
- Cut cloud cost - up to −81%
- Build a high-availability Proxmox cluster
- Virtualize with Managed Proxmox
- Design an open-source AI architecture
- Get collaboration fully managed
- Ship your prototype to production
- Connect sites and clusters securely
Hosting & operations
Enquire about hosting and operations for Graylog
Briefly describe the current state and objective for Graylog. We assess infrastructure, integration, and ongoing operations.
- Straight with Timo and Robin - no sales team, no pitch
- An honest take, including when we are not the right fit
- Concrete next steps for infrastructure, software or AI
No risk: worst case, you leave with a clearer understanding of your project than before.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.