Graylog

https://go2docs.graylog.org
Admin
Graylog is a centralized log management system that aggregates, indexes, and analyzes log data from...
Tokens:1,240,932
Snippets:9,824
Trust Score:10
Update:3 days ago
Show doc for...
Tokens:
Raw
### Install OpenSearch with Admin Password

Source: https://go2docs.graylog.org/current/downloading_and_installing_graylog/suse_installation_os.htm

Example command for installing OpenSearch while setting the required initial admin password.

```bash
sudo OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> zypper install -y opensearch
```

--------------------------------

### Install and Start Filebeat on Ubuntu

Source: https://go2docs.graylog.org/illuminate-current/content_packs/apache_tomcat_content_pack.html?TocPath=Content+Packs%7C_____3

Commands to add the Elastic repository, install Filebeat, and manage the service on Ubuntu.

```bash
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key  
							add -  
							sudo apt-get install apt-transport-https  
							echo "deb https://artifacts.elastic.co/packages/oss-8.x/apt stable main" | sudo tee -a  
							/etc/apt/sources.list.d/elastic-8.x.list  
							sudo apt-get update && sudo apt-get install filebeat  
							sudo systemctl enable filebeat  
							sudo systemctl start filebeat  
						sudo systemctl status filebeat
```

--------------------------------

### Start Graylog Web Development Server

Source: https://go2docs.graylog.org/current/what_more_can_graylog_do_for_me/plugins.html

Commands to install dependencies and start the local development server for the Graylog web interface.

```bash
cd graylog2-server/graylog2-web-interface  
yarn install  
[...]  
yarn start  
[...]  
open http://localhost:8080
```

--------------------------------

### Wait for Pod Readiness

Source: https://go2docs.graylog.org/apisecurity-current/installation_and_setup/install_graylog_api_security.htm

Run this script to monitor the installation progress and wait until the pods are fully started and the UI is accessible.

```bash
kubectl wait --for=jsonpath='{.status.loadBalancer.ingress}' service/resurface-kubernetes-ingress -n resurface && kubectl wait --for=condition=Ready pod/resurface-coordinator-0 -n resurface && echo "pod/resurface-coordinator-0 running at http://$(kubectl get svc resurface-kubernetes-ingress --namespace resurface --template '{{ (index .status.loadBalancer.ingress 0).ip }}')/ui/"
```

--------------------------------

### starts_with examples

Source: https://go2docs.graylog.org/current/making_sense_of_your_log_data/functions_index.html?TocPath=Manage+Your+Log+Data%7CPipelines%7CFunctions%7C_____1

Shows case-sensitive and case-insensitive prefix matching. The first example returns true, the second returns false.

```graylog pipeline rule
starts_with ( "Foobar Baz Quux" , "foo" , true ); 
```

```graylog pipeline rule
starts_with ( "Foobar Baz Quux" , "Quux" );
```

--------------------------------

### Enable and start OpenSearch service

Source: https://go2docs.graylog.org/current/downloading_and_installing_graylog/debian_installation_os.htm

Reload systemd, enable the OpenSearch service, and start it.

```bash
sudo systemctl daemon-reload  
sudo systemctl enable opensearch.service  
sudo systemctl start opensearch.service
```

--------------------------------

### Start Graylog Sidecar on Linux

Source: https://go2docs.graylog.org/current/getting_in_log_data/set_up_sidecar_collectors.htm

Commands to install, enable, start, and check the status of the Graylog Sidecar service on Linux systems.

```bash
sudo graylog-sidecar -service install  
sudo systemctl enable graylog-sidecar  
sudo systemctl start graylog-sidecar  
sudo systemctl status graylog-sidecar
```

--------------------------------

### Search request_method by value

Source: https://go2docs.graylog.org/apisecurity-current/sql_reference/column_definitions.htm?TocPath=SQL+Reference%7C_____4

Example query to count messages where the request_method is GET.

```sql
select count(*)
from resurface.data.messages_index
where request_method = 'GET'
```

--------------------------------

### Compile the project

Source: https://go2docs.graylog.org/current/what_more_can_graylog_do_for_me/plugins.html

Execute this command in the graylog-project directory to compile the server and your plugin.

```bash
mvn package
```

--------------------------------

### Get average risk_score

Source: https://go2docs.graylog.org/apisecurity-current/sql_reference/column_definitions.htm?TocPath=SQL+Reference%7C_____4

Example query to calculate the average risk score across all messages.

```sql
select avg(risk_score)
from resurface.data.messages_index
```

--------------------------------

### Get all details with offset and limit

Source: https://go2docs.graylog.org/apisecurity-current/sql_reference/schemas_and_views.htm?TocPath=SQL+Reference%7C_____3

Retrieves 100 rows starting from offset 50, useful for pagination.

```sql
select * from resurface.data.messages offset 50 limit 100  
```

--------------------------------

### Example JSON output for cluster nodes

Source: https://go2docs.graylog.org/current/setting_up_graylog/rest_api_use_cases.htm

The JSON-formatted output returned after executing the GET cluster request.

```json
{
"e31af544-9183-4b88-b833-37f89ed7acc0" : {
"facility" : "graylog-server",
"codename" : "Noir",
"node_id" : "***********************************************",
"cluster_id" : "**********************************************",
"version" : "7.2.0+2c5da04",
"started_at" : "****-**-**T17:46:17.818Z",
"hostname" : "gl-latest-live",
"lifecycle" : "running",
"lb_status" : "alive",
"timezone" : "America/Chicago",
"operating_system" : "Linux 5.10.0-28-amd64",
"is_leader" : true,
"is_processing" : true
}
}
```

--------------------------------

### Install Graylog Open

Source: https://go2docs.graylog.org/current/downloading_and_installing_graylog/ubuntu_installation_os.html

Commands to download the repository configuration, update the package list, and install the Graylog Open server.

```bash
wget https://packages.graylog2.org/repo/packages/graylog-7.2-repository_latest.deb  
sudo dpkg -i graylog-7.2-repository_latest.deb  
sudo apt-get update  
sudo apt-get install graylog-server
```

--------------------------------

### Manage Graylog Sidecar Service

Source: https://go2docs.graylog.org/illuminate-current/content_packs/apache_tomcat_content_pack.html?TocPath=Content+Packs%7C_____3

Commands to install, enable, start, and check the status of the Graylog Sidecar service.

```bash
sudo graylog-sidecar -service install  
							sudo systemctl enable graylog-sidecar  
							sudo systemctl start graylog-sidecar  
						sudo systemctl status graylog-sidecar
```
Tokens:
Raw