Gravwell pricing in 2026: the node-based, unlimited-ingest model
The Gravwell pricing reference. The indexer/node-based meter explained (unlimited ingest, retention, search and users, with no per-GB charge), the three free licences (2 GB/day non-commercial, 13.9 GB/day Community Edition, 50 GB/day CE Advanced), the published Professional, Enterprise and Cloud starting figures, and what happens to a node-metered bill when log volume doubles. Built from Gravwell's published pricing page and licence documentation. Updated October 2026.
Page updated 13 October 2026/First published 17 August 2026
Paid-tier figures from gravwell.io/pricing; free-tier limits from Gravwell's licence documentation; both read 13 October 2026. The pricing page shows "$35k+" and "$70k+" with no period or unit, so they are presented here as starting figures, not a rate card.
What Gravwell is, and how node-based pricing works
Gravwell is a security data and data-fusion platform. It ingests data from any source in raw, unstructured form, structure-on-read, with no schema or normalisation required at intake, and unifies logs, metrics and security data in one system that runs on-premises, in the cloud or hybrid. It serves both cyber-security investigation and threat hunting and operational-technology use cases. It was co-founded by Corey Thuen (CEO) and Kris Watts, is based in Idaho, and announced a $15.4 million Series A led by Two Bear Capital in October 2025. The positioning is built around collecting everything without a volume penalty, and the pricing model is where that shows up most concretely.
The meter is indexers, not ingest. Gravwell's pricing page states the model directly: pricing is based on the number of indexers in the cluster, and each indexer has unlimited ingest capacity, with no additional fees if your data spikes or you take on new data. Among the vendors this site tracks, that makes Gravwell a third distinct pricing shape. Splunk and Sentinel meter ingested volume; storage-model vendors meter what you retain; Gravwell meters neither and instead prices the infrastructure, the indexer nodes, you stand up to search and keep the data.
The published structure has three free licences and three commercial options. Gravwell's licence documentation lists Free (2 GB/day, non-commercial use only, no sign-up), Community Edition (13.9 GB/day, authorised for commercial use) and CE Advanced (50 GB/day, commercial use, business email required), all on a single indexer. The commercial tiers on the pricing page are Professional and Enterprise, both self-hosted, and Cloud, a Gravwell-managed deployment. The self-hosted tiers advertise unlimited data ingestion, unlimited retention, unlimited search count, unlimited users and unlimited automations; the licence docs describe Cloud ingest as contract-defined.
Gravwell does now publish starting figures. The pricing page shows Professional at "$35k+", Enterprise at "$70k+" and Cloud at "$70k+". It does not say whether those are annual, per indexer or per deployment, so this page presents them as "from" figures and does not convert them into a per-GB or per-node rate. The final number arrives through a sales conversation sized on indexer count and deployment.
Gravwell tier reference
| Tier | Price | What is published |
|---|---|---|
| Free | Free | 2 GB/day ingest, single indexer, no sign-up, non-commercial use only, never expires (Gravwell licence docs). |
| Community Edition | Free | 13.9 GB/day ingest, single indexer, free sign-up, authorised for commercial use (Gravwell licence docs). |
| CE Advanced | Free | 50 GB/day ingest, single indexer, authorised for commercial use; free after validation, business email required (Gravwell licence docs). |
| Professional (self-hosted) | From $35k | Shown as "$35k+" on the pricing page, with no period or unit stated. Priced by indexer count; unlimited data ingestion, retention, search count, users and automations. Runs in your own infrastructure. |
| Enterprise (self-hosted) | From $70k | Shown as "$70k+", no period or unit stated. Priced by indexer count, with enterprise features on top of Professional. Same unlimited-data feature set. Self-hosted. |
| Cloud (managed) | From $70k | Shown as "$70k+", no period or unit stated. Gravwell-managed deployment; the licence docs describe Cloud ingest as contract-defined. |
Source: gravwell.io/pricing (paid tiers) and docs.gravwell.io licence tiers (free tiers), both read 13 October 2026. The paid figures appear on the pricing page as "$35k+" and "$70k+" with no period or unit; the exact price for a given indexer count is quoted by sales.
The doubling test: what happens when a new service doubles your logs
The cleanest way to see what a node model changes is to run the same event through both meters: your platform team ships a new service and raw log volume doubles overnight.
The ingest-side arithmetic uses Microsoft Sentinel's published $4.30 per GB PAYG rate from our Sentinel pricing page; commitment tiers soften the doubling (to $2.96 effective at 100 GB/day) but the bill still scales with ingested volume. The Gravwell column is deliberately qualitative: because each indexer carries unlimited ingest, doubling raw volume adds no per-GB charge, and the bill only moves if the extra data forces more indexers for search or retention performance. Gravwell publishes tier starting figures but no per-indexer rate card, so the statement here is directional, not a dollar figure.
Node meter vs ingest meter, across this site's references
| Platform | What is metered | Published anchor | Raw volume doubles |
|---|---|---|---|
| Gravwell | Indexer / node count (unlimited ingest per node) | Professional from $35k, Enterprise and Cloud from $70k (no period or unit stated); free tiers to 50 GB/day | Ingest is unmetered; the bill moves only if you add indexers for search or retention headroom |
| Splunk Cloudfigures: /splunk-pricing | Ingested GB/day (or SVC workload units) | $765 to $2,049 per GB/day per year depending on commit volume ($1,265 at 50 GB/day), filed list | Metered volume doubles; the ingest bill rises about 1.6x to 2x as the per-GB band tapers |
| Microsoft Sentinelfigures: /sentinel-pricing | Ingested GB (per-GB meter) | $4.30 per GB PAYG, $2.96 effective at the 100 GB/day commitment tier | Metered volume doubles; commitment tiers soften but do not remove it |
| Pantherfigures: /panther-pricing | Ingested TB/month | $50,000/yr per 1 TB/month on the AWS Marketplace listing | Metered volume doubles; the volume meter roughly doubles |
Comparison rates are the ones already documented on this site's vendor pages, linked per row, each verified against the vendor's published pricing on the date shown on that page. The structural point is meter placement: an ingest meter prices every gigabyte that arrives, and Gravwell's node meter prices the indexers you run regardless of volume. Which lands cheaper for you depends on how much you ingest, how unpredictable it is, and how much infrastructure a node deployment needs for your search and retention targets.
Who the node model fits, and who it does not
- + High or spiky ingest: unlimited per-node ingest means volume spikes carry no per-GB penalty
- + Long retention matters: unlimited retention is part of the model, not a priced add-on
- + You want to collect everything: the whole pitch is not being forced to under-collect to control cost
- + On-prem, hybrid or OT/industrial data: self-hosted Professional and Enterprise tiers exist for exactly this
- + Small teams and evaluators: Community Edition (13.9 GB/day) and CE Advanced (50 GB/day) are free and licensed for commercial use
- - Small, steady, low ingest: a metered per-GB tier may cost less than standing up indexers
- - You need a full rate card before talking to sales: paid tiers show only starting figures ($35k+, $70k+)
- - You do not want to run infrastructure: self-hosted tiers push node and storage ops onto you
- - Procurement wants itemised meters: cost lives in node count and storage, not line-item GB/query/seat
- - Mature workflows built on an incumbent: migration effort, not pricing model, is the binding constraint
The compute and infrastructure question
Every SIEM bill has a compute component somewhere; the models differ mainly in where it sits and whether you run it. Ingest-priced platforms fold search and detection compute into the per-GB rate. Workload-priced models meter compute directly. Gravwell's node model puts compute in the indexers themselves: you provision nodes, and their capacity is what serves ingest, search and retention.
That has a clear upside and a clear cost. In its favour, there is no volume meter to fear, unlimited ingest and retention are stated features, and a heavy investigation month does not produce a surprise per-query bill. Against it, the self-hosted tiers mean you run the infrastructure, indexer nodes and their storage, so operational effort and hardware or cloud-compute cost move onto your side of the line, and beyond the published starting figures there is no per-indexer rate card to forecast against before you talk to Gravwell. On this site's usual transparency framing, Gravwell is transparent about the model (nodes, unlimited data) and the entry price, and quote-based on the exact number for your indexer count. The practical question for a buyer is whether they would rather forecast gigabytes on a published meter or indexer count on a quoted one.
Verify before you buy
As with every vendor page on this site: the figures above were read from Gravwell's pricing page and licence documentation on 13 October 2026, and SIEM pricing changes frequently. Before signing anything, confirm the current model at gravwell.io/pricing, get the indexer count behind your quote and what it supports for your workload in writing, and ask directly how many indexers your ingest and retention targets imply, how the self-hosted infrastructure cost (nodes and storage) sits alongside the Gravwell licence, whether the "$35k+" or "$70k+" figure is annual and what it covers, and what the free licences' retention and seat limits are if you plan to evaluate on one. Our methodology page explains how figures on this site are sourced and what verification means.