Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [graylog2]

Graylog is a full-featured open source log management solution. It utilizes Elasticsearch, and MongoDB to deliver high speed searches among millions of logs. It enables you to parse your logs and consolidate the information in them into graphs and various statistics.

0
votes
0answers
14 views

Mapping fields from a beats log message in graylog

this is a slightly rephrased version of: Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog) i am using filebeat to collect logs from a bunch ...
0
votes
1answer
23 views

NXLog TLS configuration

I am trying to send logs using nxlog installed on a windows server to graylog server using TLS. I have created a self signed certificate. My questions is, if I set AllowUntrusted value to True in ...
0
votes
0answers
19 views

Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog)

I am collecting logs from docker compute nodes and sending them to the beats plugin of graylog. i am using filebeat 6.4.3 with a config like this: filebeat.autodiscover: providers: - type: ...
1
vote
1answer
25 views

Analysing AWS Cloud Trail logs to get security insights

I have enabled the cloud trail logs and I get the logs to my graylog system. Now how can I do analysis on the following use cases: What if same user is trying to login and using from different Source ...
0
votes
0answers
48 views

Graylog 2.4.6 regex search

I'm running Graylog 2.4.6 and attempting to use regexes in the search function. I've successfully got it consuming log messages from some ASA firewalls. ASA syslog messages look like %ASA-6-302015:...
0
votes
0answers
37 views

See docker container logs on host while using gelf driver

I am using gelf as log driver for my docker container. In log options i provided udp endpoint. Now when i start the container, everything is working as expected. My question is, if it is possible to ...
2
votes
0answers
28 views

Keepalived forwarding UDP traffic to one node via NAT

I am having issues with load balancing UDP Syslog to my Graylog cluster nodes. At first everything seemed to work normal but it seems that traffic is flowing for 99% to one of the two nodes. I have ...
-1
votes
1answer
46 views

Graylog CSV Export is slow after upgrade

After I upgraded from graylog version 2.2.1 to 2.4.3, the csv export became quite slow compared to the previous download rate. I have to say that I did many changes putting it behind pfsense using ...
0
votes
1answer
36 views

run graylog in different port

Hi I used openstack qcow2 format and run the graylog server Now I can access my openstack machine only using floating public IP address and not via private Internal IP address. Here when I do ...
0
votes
0answers
17 views

How to make a default configuration for graylog dashboards in file

I use graylog in a docker. I'd like to make some default setup for my graylog. I know it's possible for input. But I'd like to do to do it with the dashboard configuration, and have no idea how. Any ...
2
votes
1answer
101 views

Server currently unavailable for Ubuntu 16.04

Background I have an Ubuntu 16.04 clean VM, and I am trying to install the latest version of graylog on it. Unfortunately, it is failing. What did I do? First I created a clean VM with the afore ...
0
votes
1answer
42 views

Graylog: Is it possible to view a chunk of logs all at once?

Sometimes I would like to view log entries as a "standard" looking text based log file. Right now sometimes I'll end up going to the server where the logs were generated just so I can display a ...
0
votes
0answers
70 views

Any way to save Suricata alert payload?

I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event. An ...
0
votes
1answer
89 views

rsyslog upload limitation?

I use rsyslog to upload logs to my Graylog server /etc/rsyslog.conf: $InputFileName /var/log/apache-error.log $InputFileFacility apache $InputFileTag #apacheError: $InputFileStateFile apache-error $...
0
votes
0answers
93 views

nginx amplify + graylog

i have a working nginx amplify set up ( https://www.nginx.com/products/nginx-amplify/ ) so because of it i have this as a config for my vhosts log_format main_ext '$remote_addr - $remote_user [$...
0
votes
0answers
61 views

Graylog ignore rails “No route matches” erorrs

I have graylog configured to watch for errors on my rails application with the alert config This works but most of the errors reported are spam bots looking for wordpress. Here is an example error ...
0
votes
1answer
202 views

rSyslog - Disable to push custom logs to messages

I sending my Asterisk's logs to Graylog. (its working fine) But the rSyslog write every asterisk's log to /var/log/messages not to the /var/log/asterisk/full. Asterisk logger.conf: [general] ;...
0
votes
1answer
384 views

Graylog Alert is automatically resolving itself.

Graylog v2.3.2 My goal is to have a condition raise an alert, and the alert remain open until it's marked resolved or a defined resolved condition applies. I have an alert setup and here is the ...
1
vote
0answers
210 views

Log custom header X-API-KEY from nginx to Graylog

I have an nginx (1.12.1) server running on VPS#1 and I have Graylog running on VPS#2. All sys + nginx logs are sent to Graylog. To get nginx working I've had to install the nginx content pack from ...
1
vote
0answers
200 views

How do you deploy Graylog to an AWS Linux server?

I followed these directions (graylog's website) to deploy Graylog to an Ubuntu server in AWS. I created a server with 4 GB of RAM. I created a security group that allows inbound connections on any ...
0
votes
1answer
250 views

Graylog v1.1.1: Editing source IP Address to reflect the IP inside a time stamp

I wonder if you can help with the following query? I have a client (Centos 7) server (IP 1.1.1.1) in my office that sends its logs to a Centos 7 Syslog server (IP address 1.1.1.2). The syslog server ...
0
votes
1answer
233 views

Applying item template to elasticsearch

I am trying to apply an item template to my elasticsearch cluster, to deal with the issue of having fields with content longer than 32kb. I am using version 2.4.4, as this is the highest supported ...
0
votes
1answer
62 views

Can Graylog set up an alert that triggers on a # of messages PER HOSTNAME?

I have a multi-tenant app, and I'd like to be able to have Graylog alert on things per tenant (essentially per hostname). So for example, rather than just doing this (which would aggregate data ...
0
votes
1answer
126 views

Does Graylog2 monitor services and hard disks like Icinga2?

We have graylog2 set up to monitor the syslogs, etc. However we're wondering if we can use it to monitor the different services, if they're down or not, if the hard disk is filling up. Does it ...
0
votes
2answers
257 views

Is it safe to delete Gralog Indexes

ElastiCache Cluster was in red state. Below is the out of cluster health Status { "cluster_name" : "graylog", "status" : "red", "timed_out" : false, "number_of_nodes" : 1, "number_of_data_nodes" : 1, ...
0
votes
1answer
481 views

502 Bad Gatway graylog

I am using nginx as a reverse proxy.graylog uri conf graylog.conf: rest_listen_uri= http://127.0.0.1:9000/ rest_transport_uri = http://192.168.1.1:9000/api/ nginx.conf: server { server_name ...
1
vote
1answer
753 views

Can I use AWS ES be integrated with Graylog2?

I am on a very initial setup and I want to know if I can use ES offered by AWS as a service to the Graylog2? I am quite sure this cannot be accomplished since AWS doesn't offer anything to ...
1
vote
1answer
75 views

Graylog2 - Grouping on host name variants

We are sending Apache access logs to Graylog (2.1.1). We have 70+ websites and I want to build a quick value chart for say all requests that resulted in a 5xx response. Currently when I create said ...
3
votes
2answers
901 views

Different extractors for the same Graylog input?

I'm using Graylog's sidecar functionality with Filebeat to pickup a number of different log files off my server, including Syslog, Nginx and Java App. All of these flow into the same Graylog input for ...
2
votes
3answers
1k views

Forwarding logs from rsyslog to graylog over tls

I'm trying to forward logs from rsyslog to graylog over tls. rsyslog configuration: # make gtls driver the default $DefaultNetstreamDriver gtls # # # certificate files $DefaultNetstreamDriverCAFile /...
1
vote
1answer
3k views

Loading field information in Graylog 2.1.x failed with status 500 (Internal Server Error)

I'm working on setting up a Graylog and I'm getting the following error: Loading field information failed with status: cannot GET http://192.168.2.108:12900/system/fields (500) I am on this page: ...
-1
votes
1answer
5k views

How to bind use port 514 so graylog can use as input source

How can I bind 514 so it can be used by graylog. There are examples like iptables -t nat -A PREROUTING -i eth0 -p udp -m udp --dport 514 -j REDIRECT --to-ports 5514 But what I want is to use 514 ...
0
votes
1answer
190 views

Graylog alert on unique email addresses?

We are trying to figure out if there is a way to create a stream/alert that will detect when an email address has been in a log more than X times. From what we can tell I can only count the total ...
1
vote
1answer
296 views

Graylog and ELB

We are trying to use ELB to load balance two graylog nodes. For the most part it works correctly but for certain actions like going to System-Nodes it times out and we receive the following. If we ...
0
votes
1answer
2k views

Rsyslog output in GELF

rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format. I have found bits of documentation about outputing ...
1
vote
2answers
691 views

How to securely send logs from your application?

I am currently setting up logging with graylog for my system and have a problem, that the logs can potentially contain sensitive information. The standard behaviour is to send the logs unencrypted via ...
0
votes
3answers
982 views

graylog-web 1.3 port change

I've just setup graylog server on my ubuntu server using the the apt-get feature. Graylog is currently working with no issues, but I would like to change the port from 9000 to port 80/443. I can't ...
2
votes
1answer
2k views

Graylog extractor for comma separated key value pairs

I think I'm just not understanding or missing a core concept of graylog and its extractors. I just want to take my key value pairs that are comma delimited and break them out into respective fields. ...
0
votes
1answer
2k views

Graylog How do I include message data in alert email?

I am having trouble adding relevant information to the alert emails sent from Graylog. I would like to include the actual log message that generated the email alert in the actual email alert. I am ...
1
vote
1answer
1k views

Why does graylog2 delete old indicies?

According to http://docs.graylog.org/en/1.3/pages/index_model.html, graylog2 deletes old indicies based on the "elasticsearch_max_number_of_indices". Why can't graylog2 allow no. of indicies to grow? ...
3
votes
1answer
7k views

Graylog failing to send emails (SMTP)

i am trying to let greylog2 send me email alters but i am getting this error no matter what i try? i am trying to use smtp.gmail.com as email server. This is the error message i am getting The ...
2
votes
1answer
4k views

Forward pfsenselogs to graylog

I was wondering if it is possible to forward pfsense logs (including snort) to a graylog2 server? And how can this be acomplished?
1
vote
1answer
3k views

graylog-server not binding on port 12900

I have a situation here where graylog-server does not bind to port 12900 no matter what I do. I have used github.com/graylog2/graylog-ansible-role to install the rpms for graylog-server-1.1.6-1.noarch,...
1
vote
2answers
1k views

Is there any way to see the context of a log message in Graylog2?

I've installed a Graylog2 server and begun collecting log data. It all worked fine, but as soon as I found the first Java exception with attendant stack-trace, a problem occurred to me. How can I see ...
0
votes
1answer
1k views

NXLog unable to read complete .csv file

I try to work out why NXLog can't read the complete .csf file witch has the same name but gets edited every 12 hours by windows for a export. conf file of NXLog: #define ROOT C:\Program Files\nxlog ...
0
votes
1answer
249 views

Graylog2 log submit authentication

I'm testing Graylog2 as our central log management tool for our applications. Is there a way to secure the log submit process? If we only use graylog2 in our local environment its not a big deal to ...
0
votes
1answer
198 views

Graylog ignoring all HTTP logs

I've integrated our PHP web application using Monolog recently and added support for logging into Graylog. Until very recently I've used the Graylog VM and I've successfully logged all the information ...
1
vote
1answer
1k views

Asterisk logging to Graylog2

Does anyone have any experience with logging Asterisk servers to Graylog2? I'd like to be able to send certain verbosity levels to Graylog2, but I don't have a clue how to go about it. The goal is ...
1
vote
1answer
2k views

Installing Graylog2 with puppet

I have manged to install Graylog2 from scratch by downloading all the DEB files and making the configurations. Now I try to install Graylog2 with the help of puppet in an environment and had no luck ...
0
votes
1answer
113 views

execute command in ErrorLog and log to a file in parallel

I try to use apache2gelf to send my error.log information to a graylog2 server. To use that tool I have to change the ErrorLog setting to: ErrorLog "|| /path/to/errorlog2gelf.py --vhost example.com" ...