It consists of a server written in Java that accepts your syslog messages via TCP, UDP or AMQP and stores it in the database. The second part is a web interface that allows you to manage the log messages from your web browser. Take a look at the screenshots or the latest release info page to get a feeling of what you can do with Graylog2.
All data sent to Graylog2 will appear in the web interface. Use the web interface to search and filter your data. A core part of the web interface are streams: They basically are saved searches that allow you to quickly access an overview that is already pre-filtered to match for example specific parts of your application. You can also run monitoring and alerting on single streams or directly forward all messages that are matched into a stream to other endpoints.
The Graylog2 server accepts standard syslog via TCP/UDP and GELF via UDP, TCP and HTTP. You can also send in both formats via AMQP (AMQP Docs). You can configure your syslog daemons to send their data to Graylog2 or log directly from within your applications.
