1. Recognizes graylog
1.1 Introduction
graylog is a simple to use, features a more comprehensive log management tools, graylog Elasticsearch also used as a storage and indexing to ensure performance, MongoDB to store a small amount of self-configuration, master-node model has good scalability, UI on It comes with basic query and analysis capabilities more practical and efficient, support for LDAP, access control and a wealth of log types and standards (such as syslog, GELF) and supports log-based alarm.
On the receive side logs are usually network transmission, can be TCP may also be UDP, in order of magnitude than most actual production environment using UDP, you can also be consumed by the log MQ.
1.2 Advantages
- Deployment and simple maintenance
- Small footprint
- Straightforward query syntax (grammar contrast to the ES ...)
- Built a simple alarm
- Search results can be exported to json
- UI more friendly
2. Architecture
2.1 graylog single architecture diagram
2.2 graylog cluster architecture
