Grafana Loki vs Graylog
Self-host pick — both replace Splunk (Log management + SIEM).
Both Grafana Loki and Graylog self-host as a replacement for Splunk (Log management + SIEM). Pick Grafana Loki if you want a AGPL-licensed codebase (AGPL-3.0); pick Graylog for source-available (SSPL-1.0). Both run in roughly the same cost bracket — $10-50/mo vps — loki is index-light by design; storage backed by s3 stays cheap vs $30-100/mo vps — opensearch is the heaviest component; budget by daily ingest gb.
| Grafana Lokiopen-source | Graylogopen-source | |
|---|---|---|
| License | AGPL-3.0 | SSPL-1.0 |
| Setup time | 30min docker-compose (Loki + Promtail + Grafana) | 30min docker-compose (Graylog + OpenSearch + MongoDB) |
| Monthly cost | $10-50/mo VPS — Loki is index-light by design; storage backed by S3 stays cheap. | $30-100/mo VPS — OpenSearch is the heaviest component; budget by daily ingest GB. |
| GitHub | grafana/loki | Graylog2/graylog2-server |
| Replaces | Splunk | Splunk |
Good fit for
Grafana Loki
Teams already running Prometheus/Grafana that want logs in the same UI without bringing up an ELK-class index.
Weak at:Free-text search across high-cardinality fields is slower than Elasticsearch/OpenSearch — Loki indexes labels, not content.
Graylog
Centralized log management for a single team or org with strong SIEM needs (built-in alerting, RBAC, audit trail).
Weak at:OpenSearch ops overhead — sharding, snapshots, version upgrades are non-trivial at scale.
In a terminal? npx -y github:SolvoHQ/os-alt-cli splunk prints Splunk's self-host options including both —
how the CLI works →
FAQ
Which is easier to self-host, Grafana Loki or Graylog?
Grafana Loki: 30min docker-compose (Loki + Promtail + Grafana). Graylog: 30min docker-compose (Graylog + OpenSearch + MongoDB).
What does each cost to run?
Grafana Loki: $10-50/mo VPS — Loki is index-light by design; storage backed by S3 stays cheap.. Graylog: $30-100/mo VPS — OpenSearch is the heaviest component; budget by daily ingest GB.. Both projects are free and open source.
Do Grafana Loki and Graylog replace the same SaaS?
Yes — both are open-source alternatives to Splunk.