Graylog

The Graylog Connector leading centralized log management solution for capturing, storing, and enabling real-time analysis of terabytes of machine data.

Prerequisites

The asset for this connector requires a Username and Password or an API Key, which can be generated in the UI by navigating to Administrator > Users > More Actions > Edit Tokens. To use an API Key to authorize, place the API Key in the Password field and leave Username blank.

Capabilities

This Connector provides the following capabilities:

Absolute Search

Relative Search

Notes

For more information on GrayLog: GrayLog API Documentation

Whenever you are using Query parameter, please pass it in Lucene syntax.

Additional Documentation

Graylog Connector Documentation

Graylog API Documentation

Configurations

Asset

Authenticates Graylog using Password or Token

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Account Username leave blank if using API Key	string	Optional
password	Account Password or API Key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Absolute Search

Search Graylog logs by absolute time window. Useful for log investigation during a target time window.

Endpoint

URL: /api/search/universal/absolute

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Required	Query (Lucene syntax).
parameters.from	string	Required	Timerange start. See description for date format.
parameters.to	string	Required	Timerange end. See description for date format.
parameters.limit	number	Optional	Maximum number of messages to return.
parameters.offset	number	Optional	Parameters for the Absolute Search action
parameters.filter	string	Optional	Parameters for the Absolute Search action
parameters.fields	string	Optional	Comma separated list of fields to return.
parameters.sort	string	Optional	Sorting (field:asc / field:desc).
parameters.decorate	boolean	Optional	Run decorators on search result.

Input Example

{"parameters":{"query":"Query","from":"2023-01-23T15:34:49.000Z","to":"2023-10-23T15:34:49.000Z","limit":300,"offset":12,"filter":"filter","fields":"field1,field2","sort":"timestamp","decorate":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
query	string	Output field: query
built_query	string	Output field: built_query
used_indices	array	Output field: used_indices
used_indices.file_name	string	Name of the resource
used_indices.file	string	Output field: used_indices.file
messages	array	Response message
messages.file_name	string	Name of the resource
messages.file	string	Response message
fields	array	Output field: fields
fields.file_name	string	Name of the resource
fields.file	string	Output field: fields.file
time	number	Time value
total_results	number	Result of the operation
from	string	Output field: from
to	string	Output field: to
decoration_stats	object	Output field: decoration_stats

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 03 Jan 2024 07:15:07 GMT","Content-Type":"application/json","Content-Length":"193","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Graylog-Node-ID":"3ca9c1dd-049c-4924-97ca-e18c9f78ecd9","X-Frame-Options":"DENY","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-...","X-Runtime-Microseconds":"989350"},"reason":"OK","json_body":{"query":"*","built_query":"*","used_indices":[...

Relative Search

"Graylog search for logs by a relative time window (last x minutes)",

Endpoint

URL: /api/search/universal/relative

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Required	Query (Lucene syntax)
parameters.range	number	Required	Relative timeframe to search in. See method description.
parameters.limit	number	Optional	Maximum number of messages to return.
parameters.offset	number	Optional	Parameters for the Relative Search action
parameters.filter	string	Optional	Parameters for the Relative Search action
parameters.fields	string	Optional	Comma separated list of fields to return.
parameters.sort	string	Optional	Sorting (field:asc / field:desc).
parameters.decorate	boolean	Optional	Run decorators on search result.

Input Example

{"parameters":{"query":"Query","range":300,"limit":300,"offset":12,"filter":"filter","fields":"field1,field2","sort":"timestamp","decorate":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
query	string	Output field: query
built_query	string	Output field: built_query
used_indices	array	Output field: used_indices
used_indices.file_name	string	Name of the resource
used_indices.file	string	Output field: used_indices.file
messages	array	Response message
messages.highlight_ranges	object	Response message
messages.message	object	Response message
messages.message.kubernetes_annotations_CommitId	string	Unique identifier
messages.message.gl2_remote_ip	string	Response message
messages.message.gl2_remote_port	number	Response message
messages.message.source	string	Response message
messages.message.kubernetes_labels_region	string	Response message
messages.message.gl2_source_input	string	Input data for the action
messages.message.kubernetes_labels_app	string	Response message
messages.message.kubernetes_labels_slot	string	Response message
messages.message.stream	string	Response message
messages.message.kubernetes_annotations_Branch	string	Response message
messages.message.gl2_source_node	string	Response message
messages.message.timestamp	string	Response message
messages.message.kubernetes_labels_pod-template-hash	string	Response message
messages.message.gl2_accounted_message_size	number	Response message
messages.message.streams	array	Response message

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 04 Jan 2024 11:45:31 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Content-Encoding":"gzip","X-Content-Type-Options":"nosniff","X-Graylog-Node-ID":"3ca9c1dd-049c-4924-97ca-e18c9f78ecd9","X-Frame-Options":"DENY","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-...","X-Runtime-Microseconds":"292048"},"reason":"OK","json_body":{"query":"*","...

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	193
Content-Security-Policy	HTTP response header: Content-Security-Policy	default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; img-src data: ; connect-src
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Wed, 03 Jan 2024 07:15:07 GMT
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	DENY
X-Graylog-Node-ID	HTTP response header: X-Graylog-Node-ID	3ca9c1dd-049c-4924-97ca-e18c9f78ecd9
X-Runtime-Microseconds	HTTP response header: X-Runtime-Microseconds	292048