Graylog

Graylog gathers logs from servers, containers, firewalls and network gear into one searchable archive, so you can query what the machines wrote instead of digging through a dozen log files. Inputs, pipelines and routing rules normalize and tag events as they arrive, streams separate them by source, and search, dashboards and alerting cover the rest.

Administrators and security teams use it for troubleshooting incidents and auditing access, and it works well as the central sink for a homelab or a small Kubernetes cluster.

Self-hosting keeps raw logs on your own infrastructure and avoids billing based on ingested gigabytes.