I've used it and have colleagues that have used it a few companies. I would suggest to get the most out of it, you should set up some sort of tagged logging. In Ruby, there's log4r + log4r-gelf to add additional context (e.g., Rails request GUID), that way you can easily and quickly link related messages. If you lack that flexibility, Graylog's extractors work rather nicely too. It's just a lot harder to manage, IMHO.

It's really helpful being able to pull up all requests for a single user across the cluster. Or track the status of all components of a Sidekiq job. Or see which API requests are most popular. Etc.

Yes. We've been using it in production for about 1.5 years to gather all of our syslog and our application logs. No problems at all, and we're up to about 20 shards of data now.

Honestly, I have no idea what we did before we started using it. It's an absolutely essential tool.

Yep! We do about 5k events/sec and it holds up pretty well as long as you throw enough memory at it (It's a java app). Make sure you have a cluster though if you're going to be doing those kinds of levels. Feel free to respond if you have any other questions. I'll be testing out the 1.0 release myself today.

+1

The solution seems neat. It'd be nice to know who is using it in production, how big is their environment, etc. I couldn't find much information online.

We have been using it in production, it rocks! Very powerful tool and the company behind it is full of great, helpful folks.

we are using it in production and works very well. ~200 clients sending events with a total of 63,996,350 events.