Questions tagged [graylog]

Graylog is a full-featured open source log management solution.

Filter by
Sorted by
Tagged with
0 votes
1 answer
172 views

Docker-compose rsync backup

I recently started working with docker-compose, and I'm currently in a situation where I need to upgrade the VM server. Unfortunately, I don't have access to the snapshot/restore option for certain ...
J B's user avatar
  • 93
0 votes
0 answers
83 views

Containerd GELF logging driver does not send logs to graylog

Can anyone give me some hints how can i send logs from containerd 1.6.19 to graylog using the GELF logging driver ? I have set in my /etc/containerd/config.toml : [plugins."io.containerd.grpc.v1....
TheRusko0's user avatar
2 votes
2 answers
135 views

How do we prevent accidental Graylog denial of service problems without multiple graylog instances?

Our original problem Last year we had a problem where a rogue piece of software on one server spammed our central Graylog Server with so many messages that it caused problems for other applications. ...
Mark Booth's user avatar
1 vote
0 answers
53 views

Kafka not stopping consumers when deleting group

I am sending logs from Logstash as the producer to Kafka and then consuming them from Graylog. This works as expected. However, when stopping the Graylog input, thus sending a LeaveGroup request, the ...
dmuensterer's user avatar
0 votes
1 answer
217 views

Stop filebeat sending copius metadata

I am sending data from local log files with filebeat to graylog and I am getting a 20x storage overhead compared to the original files. There are a large amount of metadata fields however I can't seem ...
Damian Games's user avatar
1 vote
0 answers
60 views

Certificate only works from client side, how do I debug something like this? (graylog/filebeat/JVM keystore)

I created 2 key-certificate pairs with the exact same method. However, while trying to setup TLS on my graylog server to a remote filebeat node, it does not successfully connect when trying to connect ...
Damian Games's user avatar
0 votes
1 answer
96 views

Multiple logging managers for different services, or one with multiple databases (graylog)

I am creating a logging infrastructure for a company with 2 unrelated services. Is it better to have: a single graylog instance that routes the logs from the two services to different elasticsearch ...
Damian Games's user avatar
1 vote
1 answer
100 views

Handle 150 req/s and 2TB of logs for 7 days of retention available by API

I would like to get advise from experienced people to build a HA infrastructure to log 2To of data in JSON format every week. I need to have a retention time of 7 days and need to be able to requests ...
michbr010's user avatar
0 votes
1 answer
471 views

Graylog - data from newest indice not returned on search

I have a Graylog server (newest version) collecting data from nginx. It´s been running for a while. I retrieve the collected data by querying my Elasticsearch cluster (v7 newest version) which ...
OpenHaus's user avatar
0 votes
1 answer
294 views

does remote logging stops local logging

I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
Retro_0's user avatar
1 vote
0 answers
465 views

Installing Graylog with Nxlog collector on a Windows DC: no service installed

I'm trying to install a NxLog collector on a Graylog client machine. The Graylog and associated infra (elastic and mongodb) is running just fine. The install client is a Windows Server 2019 DC ("...
Luiz Silveira's user avatar
0 votes
1 answer
610 views

Graylog Email Alert Password Not Working?

I recently changed my gmail password and changed the password in server.conf as well, but now graylog's email alerting fails with: Sending the email to the following server failed : smtp.gmail.com:587 ...
user avatar
1 vote
1 answer
398 views

graylog 4.0 - Injector could not be created

Trying to set up graylog with official graylog2.graylog ansible role. Installed Elasticsearch (v7.10.2) cluster on three separate servers with official elasticsearch ansible role (node_1 - master, ...
Drew's user avatar
  • 123
0 votes
1 answer
547 views

Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))

I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages ...
Felipe's user avatar
  • 1
0 votes
1 answer
1k views

Graylog does not receive logs from Docker Swarm Services

I'm new with Graylog and I'm trying to use Graylog on a Docker Container, but the logs from the others containers does not arrive on Graylog and nothing is displayed on the Graylog web interface ...
Allan Andrade's user avatar
2 votes
1 answer
2k views

When to use a new index in Graylog (Elasticsearch)?

I have been searching for days now to find a good explanation on how indices are used by Graylog/Elasticsearch and when to create a new one. There is a lot of info about sharding indices but not much ...
Holly's user avatar
  • 133
-1 votes
1 answer
669 views

How to install graylog application on GCP Kubernetes Cluster

I am trying to install CAdvisor Graylog on Kubernetes Cluster. For now I just need to install simple application. But when installing graylog using Its documentation. I am getting this error "...
Aakriti Talwar's user avatar
1 vote
0 answers
562 views

GELF json logs stop arriving on graylog after some time from nginx proxy in docker

Hmm..where to start...i've got an application stack (running in docker swarm), with nginx as proxy in front. Ive got json-formatted logs, being sent to graylog via gelf. Container system is alpine 3....
zaw's user avatar
  • 11
1 vote
0 answers
111 views

Graylog correlation rules original messages

I’m using Graylog V3.1.2 with an enterprise plugin. I created a correlation rule that triggers alert whenever two events occur. When I’m looking at the “All events” stream and find the correlation ...
Tomer's user avatar
  • 111
1 vote
0 answers
949 views

syslog udp load balancing and failover with keepalived

I have a simple two host graylog cluster for which i need to load balance udp syslog traffic, I'm using keepalived, floating ip and load balancing work perfectly, but it still directs traffic to all ...
maniel's user avatar
  • 11
0 votes
1 answer
1k views

Grok filter for Cisco ASA

How can i get port from cisco ASA syslog using grok pattern. I have tried some methods and its not working . We are using graylog for collecting log data. Eg Log : %ASA-6-301014: Teardown TCP ...
James Arems's user avatar
-1 votes
2 answers
240 views

graylog does not work out of the box

http://docs.graylog.org/en/3.0/pages/installation/docker.html $ docker run --name mongo -d mongo:3 $ docker run --name elasticsearch \ -e "http.host=0.0.0.0" \ -e "ES_JAVA_OPTS=-Xms512m -...
ses's user avatar
  • 99
0 votes
1 answer
642 views

GrayLog, can not see any logs

I install it as: $ docker run --name mongo -d mongo:3 $ docker run --name elasticsearch -p 9200:9200 -p 9300:9300 \ -e ES_JAVA_OPTS="-Xms2g -Xmx4g" \ -e "discovery.type=single-node" -e "xpack....
ses's user avatar
  • 99
1 vote
2 answers
3k views

nginx: exclude sub-location in reverse proxy configuration

I want to build a http to https reverse proxy based on nginx for a graylog instance, let's say it's url is graylog.domain.local. Graylog does NOT serve ssl encrypted connections, just standard http ...
farosch's user avatar
  • 142
0 votes
1 answer
634 views

Mapping fields from a beats log message in graylog

this is a slightly rephrased version of: Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog) i am using filebeat to collect logs from a bunch ...
rmalchow's user avatar
  • 176
0 votes
1 answer
217 views

NXLog TLS configuration

I am trying to send logs using nxlog installed on a windows server to graylog server using TLS. I have created a self signed certificate. My questions is, if I set AllowUntrusted value to True in ...
Prashant Mothukuri's user avatar
1 vote
1 answer
154 views

Analysing AWS Cloud Trail logs to get security insights

I have enabled the cloud trail logs and I get the logs to my graylog system. Now how can I do analysis on the following use cases: What if same user is trying to login and using from different Source ...
Naggappan Ramukannan's user avatar
2 votes
0 answers
2k views

Keepalived forwarding UDP traffic to one node via NAT

I am having issues with load balancing UDP Syslog to my Graylog cluster nodes. At first everything seemed to work normal but it seems that traffic is flowing for 99% to one of the two nodes. I have ...
Robert's user avatar
  • 121
-1 votes
1 answer
240 views

Graylog CSV Export is slow after upgrade

After I upgraded from graylog version 2.2.1 to 2.4.3, the csv export became quite slow compared to the previous download rate. I have to say that I did many changes putting it behind pfsense using ...
AHT's user avatar
  • 166
0 votes
1 answer
2k views

run graylog in different port

Hi I used openstack qcow2 format and run the graylog server Now I can access my openstack machine only using floating public IP address and not via private Internal IP address. Here when I do ...
Naggappan Ramukannan's user avatar
2 votes
1 answer
370 views

Server currently unavailable for Ubuntu 16.04

Background I have an Ubuntu 16.04 clean VM, and I am trying to install the latest version of graylog on it. Unfortunately, it is failing. What did I do? First I created a clean VM with the afore ...
Flame_Phoenix's user avatar
1 vote
1 answer
837 views

Graylog: Is it possible to view a chunk of logs all at once?

Sometimes I would like to view log entries as a "standard" looking text based log file. Right now sometimes I'll end up going to the server where the logs were generated just so I can display a ...
emmdee's user avatar
  • 2,267
0 votes
1 answer
413 views

Any way to save Suricata alert payload?

I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event. An ...
Server Fault's user avatar
  • 3,774
7 votes
1 answer
17k views

Send NGINX logs to Graylog

I'm trying to collect nginx error and access logs with graylog, I think everything is correctly configured, but Graylog receive nothing from NGINX (Graylog & NGINX are in docker containers and ...
MickaelCa's user avatar
0 votes
1 answer
791 views

rsyslog upload limitation?

I use rsyslog to upload logs to my Graylog server /etc/rsyslog.conf: $InputFileName /var/log/apache-error.log $InputFileFacility apache $InputFileTag #apacheError: $InputFileStateFile apache-error $...
Paul's user avatar
  • 103
0 votes
1 answer
1k views

Graylog Alert is automatically resolving itself.

Graylog v2.3.2 My goal is to have a condition raise an alert, and the alert remain open until it's marked resolved or a defined resolved condition applies. I have an alert setup and here is the ...
emmdee's user avatar
  • 2,267
3 votes
0 answers
1k views

Log custom header X-API-KEY from nginx to Graylog

I have an nginx (1.12.1) server running on VPS#1 and I have Graylog running on VPS#2. All sys + nginx logs are sent to Graylog. To get nginx working I've had to install the nginx content pack from ...
narzero's user avatar
  • 175
1 vote
0 answers
481 views

How do you deploy Graylog to an AWS Linux server?

I followed these directions (graylog's website) to deploy Graylog to an Ubuntu server in AWS. I created a server with 4 GB of RAM. I created a security group that allows inbound connections on any ...
Jermoe's user avatar
  • 11
0 votes
1 answer
576 views

Graylog v1.1.1: Editing source IP Address to reflect the IP inside a time stamp

I wonder if you can help with the following query? I have a client (Centos 7) server (IP 1.1.1.1) in my office that sends its logs to a Centos 7 Syslog server (IP address 1.1.1.2). The syslog server ...
danielsaan's user avatar
0 votes
1 answer
841 views

Applying item template to elasticsearch

I am trying to apply an item template to my elasticsearch cluster, to deal with the issue of having fields with content longer than 32kb. I am using version 2.4.4, as this is the highest supported ...
Morten Toudahl's user avatar
0 votes
1 answer
114 views

Can Graylog set up an alert that triggers on a # of messages PER HOSTNAME?

I have a multi-tenant app, and I'd like to be able to have Graylog alert on things per tenant (essentially per hostname). So for example, rather than just doing this (which would aggregate data ...
Keith Palmer Jr.'s user avatar
0 votes
1 answer
177 views

Does Graylog2 monitor services and hard disks like Icinga2?

We have graylog2 set up to monitor the syslogs, etc. However we're wondering if we can use it to monitor the different services, if they're down or not, if the hard disk is filling up. Does it ...
Pat's user avatar
  • 133
0 votes
1 answer
3k views

Graylog stream getting events, but is empty

I've started sending Palo Alto logs to Graylog, and a stream rule picks them out by matching "Palo Alto" in a "tags" field (which is how all my stream rules are; a front-end Logstash instance does the ...
armani's user avatar
  • 420
0 votes
2 answers
2k views

Is it safe to delete Gralog Indexes

ElastiCache Cluster was in red state. Below is the out of cluster health Status { "cluster_name" : "graylog", "status" : "red", "timed_out" : false, "number_of_nodes" : 1, "number_of_data_nodes" : 1, ...
tessie's user avatar
  • 101
0 votes
1 answer
2k views

502 Bad Gatway graylog

I am using nginx as a reverse proxy.graylog uri conf graylog.conf: rest_listen_uri= http://127.0.0.1:9000/ rest_transport_uri = http://192.168.1.1:9000/api/ nginx.conf: server { server_name ...
tessie's user avatar
  • 101
2 votes
2 answers
5k views

Graylog: Fields from Pipeline rule not showing up in search data

I'm trying out Graylog for system logs and Snort alerts. I've followed the example here to get my snort alerts into Graylog and then proceeded to add another Stream, Pipeline and Rule for a separate ...
Server Fault's user avatar
  • 3,774
3 votes
1 answer
142 views

restrict which server can send logs to graylog

I can send logs to graylog server by providing specific details in my rsyslog file on the node.Something like this *.* @logs.example.com:1337 My question is that if someone else also has this info ...
thinkingmonster's user avatar
0 votes
1 answer
4k views

elasticsearch: limiting disk space

I'm using elasticsearch in conjunction with Graylog. Is there a way to limit the size of the elasticsearch database, possibly using a round-robin database approach for the logs? My setup is ...
watain's user avatar
  • 151
1 vote
1 answer
1k views

Can I use AWS ES be integrated with Graylog2?

I am on a very initial setup and I want to know if I can use ES offered by AWS as a service to the Graylog2? I am quite sure this cannot be accomplished since AWS doesn't offer anything to ...
Kittystone's user avatar
1 vote
1 answer
143 views

Graylog2 - Grouping on host name variants

We are sending Apache access logs to Graylog (2.1.1). We have 70+ websites and I want to build a quick value chart for say all requests that resulted in a 5xx response. Currently when I create said ...
grahamjgreen's user avatar