--- title: Graylog slug: connectors/graylog docTags: createdAt: 2026-06-09T16:29:37.923Z --- The Graylog Connector leading centralized log management solution for capturing, storing, and enabling real-time analysis of terabytes of machine data. ## Prerequisites The asset for this connector requires a `Username` and `Password` or an API Key, which can be generated in the UI by navigating to `Administrator > Users > More Actions > Edit Tokens`. To use an API Key to authorize, place the API Key in the `Password` field and leave `Username` blank. ## Capabilities This Connector provides the following capabilities: - Absolute Search - Relative Search ## Notes For more information on GrayLog: [GrayLog API Documentation](https://circles.graylog.cloud/api/api-browser/global/index.html#!/System/Inputs) - Whenever you are using `Query` parameter, please pass it in Lucene syntax. ## Additional Documentation - [Graylog Connector Documentation](https://docs.swimlane.com/connectors/graylog) - [Graylog API Documentation](https://circles.graylog.cloud/api/api-browser/global/index.html#!/System/Inputs) # Configurations ## Asset Authenticates Graylog using Password or Token ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | --------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Account Username leave blank if using API Key | string | Optional | | password | Account Password or API Key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Absolute Search Search Graylog logs by absolute time window. Useful for log investigation during a target time window. ### Endpoint - **URL:** `/api/search/universal/absolute` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.query` | string | Required | Query (Lucene syntax). | | `parameters.from` | string | Required | Timerange start. See description for date format. | | `parameters.to` | string | Required | Timerange end. See description for date format. | | `parameters.limit` | number | Optional | Maximum number of messages to return. | | `parameters.offset` | number | Optional | Parameters for the Absolute Search action | | `parameters.filter` | string | Optional | Parameters for the Absolute Search action | | `parameters.fields` | string | Optional | Comma separated list of fields to return. | | `parameters.sort` | string | Optional | Sorting (field\:asc / field\:desc). | | `parameters.decorate` | boolean | Optional | Run decorators on search result. | ### Input Example `{"parameters":{"query":"Query","from":"2023-01-23T15:34:49.000Z","to":"2023-10-23T15:34:49.000Z","limit":300,"offset":12,"filter":"filter","fields":"field1,field2","sort":"timestamp","decorate":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `query` | string | Output field: query | | `built_query` | string | Output field: built\_query | | `used_indices` | array | Output field: used\_indices | | `used_indices.file_name` | string | Name of the resource | | `used_indices.file` | string | Output field: used\_indices.file | | `messages` | array | Response message | | `messages.file_name` | string | Name of the resource | | `messages.file` | string | Response message | | `fields` | array | Output field: fields | | `fields.file_name` | string | Name of the resource | | `fields.file` | string | Output field: fields.file | | `time` | number | Time value | | `total_results` | number | Result of the operation | | `from` | string | Output field: from | | `to` | string | Output field: to | | `decoration_stats` | object | Output field: decoration\_stats | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 03 Jan 2024 07:15:07 GMT","Content-Type":"application/json","Content-Length":"193","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Graylog-Node-ID":"3ca9c1dd-049c-4924-97ca-e18c9f78ecd9","X-Frame-Options":"DENY","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-...","X-Runtime-Microseconds":"989350"},"reason":"OK","json_body":{"query":"*","built_query":"*","used_indices":[...` ## Relative Search "Graylog search for logs by a relative time window (last x minutes)", ### Endpoint - **URL:** `/api/search/universal/relative` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | -------------------------------------------------------- | | `parameters.query` | string | Required | Query (Lucene syntax) | | `parameters.range` | number | Required | Relative timeframe to search in. See method description. | | `parameters.limit` | number | Optional | Maximum number of messages to return. | | `parameters.offset` | number | Optional | Parameters for the Relative Search action | | `parameters.filter` | string | Optional | Parameters for the Relative Search action | | `parameters.fields` | string | Optional | Comma separated list of fields to return. | | `parameters.sort` | string | Optional | Sorting (field\:asc / field\:desc). | | `parameters.decorate` | boolean | Optional | Run decorators on search result. | ### Input Example `{"parameters":{"query":"Query","range":300,"limit":300,"offset":12,"filter":"filter","fields":"field1,field2","sort":"timestamp","decorate":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `query` | string | Output field: query | | `built_query` | string | Output field: built\_query | | `used_indices` | array | Output field: used\_indices | | `used_indices.file_name` | string | Name of the resource | | `used_indices.file` | string | Output field: used\_indices.file | | `messages` | array | Response message | | `messages.highlight_ranges` | object | Response message | | `messages.message` | object | Response message | | `messages.message.kubernetes_annotations_CommitId` | string | Unique identifier | | `messages.message.gl2_remote_ip` | string | Response message | | `messages.message.gl2_remote_port` | number | Response message | | `messages.message.source` | string | Response message | | `messages.message.kubernetes_labels_region` | string | Response message | | `messages.message.gl2_source_input` | string | Input data for the action | | `messages.message.kubernetes_labels_app` | string | Response message | | `messages.message.kubernetes_labels_slot` | string | Response message | | `messages.message.stream` | string | Response message | | `messages.message.kubernetes_annotations_Branch` | string | Response message | | `messages.message.gl2_source_node` | string | Response message | | `messages.message.timestamp` | string | Response message | | `messages.message.kubernetes_labels_pod-template-hash` | string | Response message | | `messages.message.gl2_accounted_message_size` | number | Response message | | `messages.message.streams` | array | Response message | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 04 Jan 2024 11:45:31 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Content-Encoding":"gzip","X-Content-Type-Options":"nosniff","X-Graylog-Node-ID":"3ca9c1dd-049c-4924-97ca-e18c9f78ecd9","X-Frame-Options":"DENY","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-...","X-Runtime-Microseconds":"292048"},"reason":"OK","json_body":{"query":"*","...` # Response Headers | **Header** | **Description** | **Example** | | ----------------------- | ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 193 | | Content-Security-Policy | HTTP response header: Content-Security-Policy | default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; img-src data: \*; connect-src \* | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Wed, 03 Jan 2024 07:15:07 GMT | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | DENY | | X-Graylog-Node-ID | HTTP response header: X-Graylog-Node-ID | 3ca9c1dd-049c-4924-97ca-e18c9f78ecd9 | | X-Runtime-Microseconds | HTTP response header: X-Runtime-Microseconds | 292048 |