Questions tagged [graylog]

Graylog is a full-featured open source log management solution.

Filter by
Sorted by
Tagged with
0 votes
1 answer
71 views

Graylog - data from newest indice not returned on search

I have a Graylog server (newest version) collecting data from nginx. It´s been running for a while. I retrieve the collected data by querying my Elasticsearch cluster (v7 newest version) which ...
user avatar
0 votes
1 answer
36 views

does remote logging stops local logging

I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
user avatar
1 vote
0 answers
116 views

Installing Graylog with Nxlog collector on a Windows DC: no service installed

I'm trying to install a NxLog collector on a Graylog client machine. The Graylog and associated infra (elastic and mongodb) is running just fine. The install client is a Windows Server 2019 DC ("...
user avatar
0 votes
0 answers
43 views

HA Proxy - Header as a Variable

Is there a way I can eliminate the need for hardcoded server name "graylog.example.org" from the haproxy.cfg ? https://docs.graylog.org/docs/web-interface frontend http bind 0.0.0.0:80 ...
user avatar
0 votes
1 answer
257 views

Graylog Email Alert Password Not Working?

I recently changed my gmail password and changed the password in server.conf as well, but now graylog's email alerting fails with: Sending the email to the following server failed : smtp.gmail.com:587 ...
user avatar
  • 75
0 votes
1 answer
158 views

graylog 4.0 - Injector could not be created

Trying to set up graylog with official graylog2.graylog ansible role. Installed Elasticsearch (v7.10.2) cluster on three separate servers with official elasticsearch ansible role (node_1 - master, ...
user avatar
  • 101
0 votes
0 answers
63 views

TripleO: How to configure containerized rsyslog to use graylog instead of elasticsearch

Overview Let me first give a short overview of what we want to accomplish. I am currently helping to deploy a TripleO Openstack Cloud, and we would like to use a different way of storing the logs ...
user avatar
  • 1
0 votes
1 answer
147 views

Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))

I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages ...
user avatar
  • 1
0 votes
1 answer
468 views

Graylog does not receive logs from Docker Swarm Services

I'm new with Graylog and I'm trying to use Graylog on a Docker Container, but the logs from the others containers does not arrive on Graylog and nothing is displayed on the Graylog web interface ...
user avatar
  • 101
2 votes
1 answer
1k views

When to use a new index in Graylog (Elasticsearch)?

I have been searching for days now to find a good explanation on how indices are used by Graylog/Elasticsearch and when to create a new one. There is a lot of info about sharding indices but not much ...
user avatar
  • 133
-1 votes
1 answer
253 views

How to install graylog application on GCP Kubernetes Cluster

I am trying to install CAdvisor Graylog on Kubernetes Cluster. For now I just need to install simple application. But when installing graylog using Its documentation. I am getting this error "...
user avatar
1 vote
0 answers
364 views

GELF json logs stop arriving on graylog after some time from nginx proxy in docker

Hmm..where to start...i've got an application stack (running in docker swarm), with nginx as proxy in front. Ive got json-formatted logs, being sent to graylog via gelf. Container system is alpine 3....
user avatar
  • 11
1 vote
0 answers
91 views

Graylog correlation rules original messages

I’m using Graylog V3.1.2 with an enterprise plugin. I created a correlation rule that triggers alert whenever two events occur. When I’m looking at the “All events” stream and find the correlation ...
user avatar
  • 11
1 vote
0 answers
661 views

syslog udp load balancing and failover with keepalived

I have a simple two host graylog cluster for which i need to load balance udp syslog traffic, I'm using keepalived, floating ip and load balancing work perfectly, but it still directs traffic to all ...
user avatar
  • 11
0 votes
1 answer
795 views

Grok filter for Cisco ASA

How can i get port from cisco ASA syslog using grok pattern. I have tried some methods and its not working . We are using graylog for collecting log data. Eg Log : %ASA-6-301014: Teardown TCP ...
user avatar
-1 votes
1 answer
108 views

graylog does not work out of the box

http://docs.graylog.org/en/3.0/pages/installation/docker.html $ docker run --name mongo -d mongo:3 $ docker run --name elasticsearch \ -e "http.host=0.0.0.0" \ -e "ES_JAVA_OPTS=-Xms512m -...
user avatar
  • 99
0 votes
1 answer
412 views

GrayLog, can not see any logs

I install it as: $ docker run --name mongo -d mongo:3 $ docker run --name elasticsearch -p 9200:9200 -p 9300:9300 \ -e ES_JAVA_OPTS="-Xms2g -Xmx4g" \ -e "discovery.type=single-node" -e "xpack....
user avatar
  • 99
1 vote
2 answers
2k views

nginx: exclude sub-location in reverse proxy configuration

I want to build a http to https reverse proxy based on nginx for a graylog instance, let's say it's url is graylog.domain.local. Graylog does NOT serve ssl encrypted connections, just standard http ...
user avatar
  • 142
0 votes
1 answer
277 views

Mapping fields from a beats log message in graylog

this is a slightly rephrased version of: Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog) i am using filebeat to collect logs from a bunch ...
user avatar
  • 166
0 votes
1 answer
177 views

NXLog TLS configuration

I am trying to send logs using nxlog installed on a windows server to graylog server using TLS. I have created a self signed certificate. My questions is, if I set AllowUntrusted value to True in ...
user avatar
1 vote
1 answer
135 views

Analysing AWS Cloud Trail logs to get security insights

I have enabled the cloud trail logs and I get the logs to my graylog system. Now how can I do analysis on the following use cases: What if same user is trying to login and using from different Source ...
user avatar
2 votes
0 answers
1k views

Keepalived forwarding UDP traffic to one node via NAT

I am having issues with load balancing UDP Syslog to my Graylog cluster nodes. At first everything seemed to work normal but it seems that traffic is flowing for 99% to one of the two nodes. I have ...
user avatar
  • 121
-1 votes
1 answer
130 views

Graylog CSV Export is slow after upgrade

After I upgraded from graylog version 2.2.1 to 2.4.3, the csv export became quite slow compared to the previous download rate. I have to say that I did many changes putting it behind pfsense using ...
user avatar
  • 166
0 votes
1 answer
866 views

run graylog in different port

Hi I used openstack qcow2 format and run the graylog server Now I can access my openstack machine only using floating public IP address and not via private Internal IP address. Here when I do ...
user avatar
2 votes
1 answer
346 views

Server currently unavailable for Ubuntu 16.04

Background I have an Ubuntu 16.04 clean VM, and I am trying to install the latest version of graylog on it. Unfortunately, it is failing. What did I do? First I created a clean VM with the afore ...
user avatar
1 vote
1 answer
513 views

Graylog: Is it possible to view a chunk of logs all at once?

Sometimes I would like to view log entries as a "standard" looking text based log file. Right now sometimes I'll end up going to the server where the logs were generated just so I can display a ...
user avatar
  • 1,835
0 votes
1 answer
330 views

Any way to save Suricata alert payload?

I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event. An ...
user avatar
  • 3,434
7 votes
1 answer
14k views

Send NGINX logs to Graylog

I'm trying to collect nginx error and access logs with graylog, I think everything is correctly configured, but Graylog receive nothing from NGINX (Graylog & NGINX are in docker containers and ...
user avatar
0 votes
1 answer
617 views

rsyslog upload limitation?

I use rsyslog to upload logs to my Graylog server /etc/rsyslog.conf: $InputFileName /var/log/apache-error.log $InputFileFacility apache $InputFileTag #apacheError: $InputFileStateFile apache-error $...
user avatar
  • 103
0 votes
1 answer
922 views

rSyslog - Disable to push custom logs to messages

I sending my Asterisk's logs to Graylog. (its working fine) But the rSyslog write every asterisk's log to /var/log/messages not to the /var/log/asterisk/full. Asterisk logger.conf: [general] ;...
user avatar
  • 123
0 votes
1 answer
1k views

Graylog Alert is automatically resolving itself.

Graylog v2.3.2 My goal is to have a condition raise an alert, and the alert remain open until it's marked resolved or a defined resolved condition applies. I have an alert setup and here is the ...
user avatar
  • 1,835
2 votes
0 answers
871 views

Log custom header X-API-KEY from nginx to Graylog

I have an nginx (1.12.1) server running on VPS#1 and I have Graylog running on VPS#2. All sys + nginx logs are sent to Graylog. To get nginx working I've had to install the nginx content pack from ...
user avatar
  • 165
1 vote
0 answers
423 views

How do you deploy Graylog to an AWS Linux server?

I followed these directions (graylog's website) to deploy Graylog to an Ubuntu server in AWS. I created a server with 4 GB of RAM. I created a security group that allows inbound connections on any ...
user avatar
  • 11
0 votes
1 answer
474 views

Graylog v1.1.1: Editing source IP Address to reflect the IP inside a time stamp

I wonder if you can help with the following query? I have a client (Centos 7) server (IP 1.1.1.1) in my office that sends its logs to a Centos 7 Syslog server (IP address 1.1.1.2). The syslog server ...
user avatar
0 votes
1 answer
780 views

Applying item template to elasticsearch

I am trying to apply an item template to my elasticsearch cluster, to deal with the issue of having fields with content longer than 32kb. I am using version 2.4.4, as this is the highest supported ...
user avatar
0 votes
1 answer
88 views

Can Graylog set up an alert that triggers on a # of messages PER HOSTNAME?

I have a multi-tenant app, and I'd like to be able to have Graylog alert on things per tenant (essentially per hostname). So for example, rather than just doing this (which would aggregate data ...
user avatar
0 votes
1 answer
167 views

Does Graylog2 monitor services and hard disks like Icinga2?

We have graylog2 set up to monitor the syslogs, etc. However we're wondering if we can use it to monitor the different services, if they're down or not, if the hard disk is filling up. Does it ...
user avatar
  • 133
0 votes
1 answer
2k views

Graylog stream getting events, but is empty

I've started sending Palo Alto logs to Graylog, and a stream rule picks them out by matching "Palo Alto" in a "tags" field (which is how all my stream rules are; a front-end Logstash instance does the ...
user avatar
  • 420
0 votes
2 answers
2k views

Is it safe to delete Gralog Indexes

ElastiCache Cluster was in red state. Below is the out of cluster health Status { "cluster_name" : "graylog", "status" : "red", "timed_out" : false, "number_of_nodes" : 1, "number_of_data_nodes" : 1, ...
user avatar
  • 101
0 votes
1 answer
2k views

502 Bad Gatway graylog

I am using nginx as a reverse proxy.graylog uri conf graylog.conf: rest_listen_uri= http://127.0.0.1:9000/ rest_transport_uri = http://192.168.1.1:9000/api/ nginx.conf: server { server_name ...
user avatar
  • 101
2 votes
2 answers
4k views

Graylog: Fields from Pipeline rule not showing up in search data

I'm trying out Graylog for system logs and Snort alerts. I've followed the example here to get my snort alerts into Graylog and then proceeded to add another Stream, Pipeline and Rule for a separate ...
user avatar
  • 3,434
3 votes
1 answer
107 views

restrict which server can send logs to graylog

I can send logs to graylog server by providing specific details in my rsyslog file on the node.Something like this *.* @logs.example.com:1337 My question is that if someone else also has this info ...
user avatar
0 votes
1 answer
4k views

elasticsearch: limiting disk space

I'm using elasticsearch in conjunction with Graylog. Is there a way to limit the size of the elasticsearch database, possibly using a round-robin database approach for the logs? My setup is ...
user avatar
  • 141
1 vote
1 answer
1k views

Can I use AWS ES be integrated with Graylog2?

I am on a very initial setup and I want to know if I can use ES offered by AWS as a service to the Graylog2? I am quite sure this cannot be accomplished since AWS doesn't offer anything to ...
user avatar
1 vote
1 answer
96 views

Graylog2 - Grouping on host name variants

We are sending Apache access logs to Graylog (2.1.1). We have 70+ websites and I want to build a quick value chart for say all requests that resulted in a 5xx response. Currently when I create said ...
user avatar
3 votes
2 answers
2k views

Different extractors for the same Graylog input?

I'm using Graylog's sidecar functionality with Filebeat to pickup a number of different log files off my server, including Syslog, Nginx and Java App. All of these flow into the same Graylog input for ...
user avatar
  • 632
2 votes
3 answers
3k views

Forwarding logs from rsyslog to graylog over tls

I'm trying to forward logs from rsyslog to graylog over tls. rsyslog configuration: # make gtls driver the default $DefaultNetstreamDriver gtls # # # certificate files $DefaultNetstreamDriverCAFile /...
user avatar
  • 123
1 vote
1 answer
3k views

Loading field information in Graylog 2.1.x failed with status 500 (Internal Server Error)

I'm working on setting up a Graylog and I'm getting the following error: Loading field information failed with status: cannot GET http://192.168.2.108:12900/system/fields (500) I am on this page: ...
user avatar
  • 3,811
-1 votes
1 answer
9k views

How to bind use port 514 so graylog can use as input source

How can I bind 514 so it can be used by graylog. There are examples like iptables -t nat -A PREROUTING -i eth0 -p udp -m udp --dport 514 -j REDIRECT --to-ports 5514 But what I want is to use 514 ...
user avatar
  • 202
0 votes
1 answer
333 views

Graylog alert on unique email addresses?

We are trying to figure out if there is a way to create a stream/alert that will detect when an email address has been in a log more than X times. From what we can tell I can only count the total ...
user avatar
  • 351