The following article exclusively pertains to a Graylog Enterprise feature or functionality. To learn more about obtaining an Enterprise license, please contact the Graylog Sales team.

Graylog Operations licenses provide support for users. These licenses (depending on the license type), offer extra support and features that are not included in Graylog Open.

There are two types of Operations licenses: Graylog Operations and Graylog Security licenses. Graylog Cloud user licenses are managed by Graylog and will not appear in the web interface.

Hint: Multiple Operations licenses can be applied at the same time.

Graylog Operations License

The Operations license offers all the features of Graylog Open plus additional Operations features such as: the Graylog collector Sidecar, enterprise-class log management and analysis, Smart Kafka Routing, out-of-the-box parsing, Operations dashboards, scheduled reporting, and support. Licensed multi-cluster environments receive Operations features and benefits that are not available for Graylog Open multi-cluster environments

Operations environments are allowed up to 5 GB daily. The daily ingestion volume is calculated at the point right before logs are being sent to the default output, which is typically Elasticsearch. The size of each message that passes through is calculated and then added to an internal counter. Each message field visible to the user is calculated, including the message and full_message fields. Internally added fields, such as gl2_source_node are not calculated.

Graylog Security License

The Security license was designed exclusively for security use cases by analysts. It covers security-related features such as Machine Learning(ML)/Artificial Intelligence(AI), an event correlation engine, built-in security expertise, dashboards, and enterprise support.

Hint: You must have an Operations license AND a Security license to make use of both sets of features.

The Security license also provides access to Graylog Security content packs. It operates solely within the limits of these content packs.

Import a License

Both Operations and Security licenses are set up the same way in Graylog. Once you have obtained a license, you can import it into your Graylog setup via the following steps:

  1. As an administrative user go to Enterprise > Licenses in the web interface.
  2. Click on Import new license in the top right-hand corner.
  3. Copy the license text from the confirmation email and paste it into the text field. Click Import license.
  4. If the license is valid, a preview of your license details should appear below the text field.
  5. Click Import to activate the license.

The license automatically applies to all nodes in your cluster. There is no need to restart the server nodes.

Warning: If there are errors, please check that you copied the entire license from the license email without line breaks. The same license is also attached as a text file in case it is incorrectly formatted in the email.

Verify Your License

Some Graylog licenses require validity checks on a regular basis. This includes the free Graylog Operations license with a specific amount of traffic included.

If your network environment requires Graylog to use a proxy server to communicate with the external services via https, you will need to configure the proxy server in the Graylog configuration file.

The Graylog web interface displays details about the license. If you have any further questions, please contact our Sales team.

Review License Verification

Graylog Operations periodically sends the following information to api.graylog.com via https on TCP port 443 for each installed license:

  • The ID of the license.
  • The ID of the Graylog cluster.
  • A flag indicator, if the license is violated.
  • A flag indicator, if the license has expired.
  • A flag indicator if Graylog detected that the traffic measuring mechanisms have been modified.
  • A list of how much traffic was received and written by Graylog in the recent days (in bytes).

Hint: If your license breaks, it will convert back to Graylog Open and continue to collect logs.

Monitor Licensed Traffic

To view information on licensed traffic limits and monitor outgoing traffic within the last 30 days, click on System > Overview in the Graylog interface.

Know Your Threshold

Graylog Operations and Graylog Security licenses are issued based on daily log volume written to storage. A Graylog Operations or Security license allows 5 overages within a rolling 30-day period. If users exceed their licensed volume within the 30 days, they will be automatically locked out of licensed features and presented with a notice.

Please contact your Customer Success Manager if:

  • You are locked out of licensed features due to exceeding the license threshold (a temporary license can be issued).

  • You need to increase your license volume or have questions about your license.

Remove an Existing License

Warning: If you plan to remove an expired license, please apply the new license before doing so to prevent any gaps in licensing.

If you would like to delete an existing Operations license, follow the steps below:

  • Go to Enterprise > Licenses in the Graylog interface.

  • Click on Delete next to the license you want to remove.

  • Click on Delete in the confirmation dialog.

  • Refresh the page.