Graylog

https://go2docs.graylog.org/6-1/home.htm
Admin
Graylog is a powerful log management and security analytics platform that enables users to collect,...
Tokens:1,027,633
Snippets:7,825
Trust Score:10
Update:1 year ago
Show doc for...
Tokens:
Raw
### Start Graylog Forwarder Service (RPM)

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/getting_in_log_data/forwarder_installation

Starts the Graylog Forwarder service after installation and configuration.

```shell
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Start Graylog Forwarder Service (DEB)

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/getting_in_log_data/forwarder_installation

Starts the Graylog Forwarder service after installation and configuration.

```shell
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Start OpenSearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/suse_installation

This command starts the OpenSearch service.

```Shell
sudo systemctl start opensearch
```

--------------------------------

### Enable Graylog Server to Start on Boot (systemd)

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/installing_graylog_operations

Commands to configure the Graylog server service to automatically start when the operating system boots up, using systemd.

```Shell
sudo systemctl enable graylog-server
```

--------------------------------

### Start Graylog Forwarder Service (RPM)

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/Getting_in_Log_Data/Forwarder_Installation

Starts the Graylog Forwarder service on systems using `systemd` after installation and configuration for RPM packages.

```Shell
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Start OpenSearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/suse_installation

This command explicitly starts the OpenSearch service using systemctl.

```bash
sudo systemctl start opensearch
```

--------------------------------

### Start Graylog Forwarder Service (DEB)

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/Getting_in_Log_Data/Forwarder_Installation

Starts the Graylog Forwarder service on systems using `systemd` after installation and configuration for DEB packages.

```Shell
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Graylog Forwarder Agent Inputs List API Response Example

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/getting_in_log_data/forwarder

Example JSON response from the GET /api/inputs endpoint of the Graylog Forwarder Agent REST API, providing a list of configured inputs running on the forwarder, including their IDs and titles.

```JSON
{
	"inputs" : [
		{
			"id" : "5fc91564d44bfd2000249e8c" ,
			"title" : "Random"
		},
		{
			"id" : "5fc91550d44bfd2000249e74" ,
			"title" : "Beats"
		}
	]
}
```

--------------------------------

### Enable and Start OpenSearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/ubuntu_installation

Reloads systemd manager configuration, enables OpenSearch to start on boot, starts the service, and checks its status.

```bash
sudo systemctl daemon-reload
sudo systemctl enable opensearch.service
sudo systemctl start opensearch.service
sudo systemctl status opensearch.service
```

--------------------------------

### Start Graylog Forwarder and Verify Startup

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/getting_in_log_data/forwarder

Instructions and command to start the Graylog Forwarder using its binaries, along with the expected success message displayed in the console upon successful startup.

```shell
./bin/graylog-forwarder run --configfile forwarder.conf.
```

```console
INFO: Forwarder Service started successfully.
```

--------------------------------

### Example Graylog Plugin Directory Structure

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/graylog_oss_to_operations

Illustrates the typical contents of the Graylog server plugin directory after installing the Operations plugin, showing various `.jar` files.

```Shell
plugin/
├── graylog-plugin-aws-4.0.1.jar
├── graylog-plugin-collector-4.0.1.jar
├── graylog-plugin-enterprise-4.0.1.jar
└── graylog-plugin-threatintel-4.0.1.jar
```

--------------------------------

### Enable Graylog Server Service to Start on Boot

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/installing_graylog_operations

Commands to configure the Graylog server service to automatically start when the operating system boots up. These commands integrate Graylog into the system's startup process using either SysV or systemd init systems.

```bash
sudo update-rc.dgraylog-server defaults95 10
```

```bash
sudo systemctl enable graylog-server
```

--------------------------------

### Copying Graylog Server Configuration File

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/manual_installation_on_linux

This command copies the example Graylog server configuration file to its default location, `/etc/graylog/server/server.conf`, as a starting point for customization. Users should then edit this file to configure essential parameters.

```Shell
cp graylog.conf.example /etc/graylog/server/server.conf
```

--------------------------------

### Enable and Start OpenSearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/suse_installation

These commands reload the systemd daemon, enable the OpenSearch service to start on boot, and immediately start the service.

```Shell
sudo systemctl daemon-reload
sudo systemctl enable opensearch.service
sudo systemctl start opensearch.service
```

--------------------------------

### Enable and Start OpenSearch System Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/ubuntu_installation

These commands reload the systemd daemon, enable the OpenSearch service to start on boot, start the service immediately, and then check its current status to ensure it's running correctly.

```Shell
sudo systemctl daemon-reload
sudo systemctl enable opensearch.service
sudo systemctl start opensearch.service
sudo systemctl status opensearch.service
```

--------------------------------

### Copy Graylog Example Configuration File

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/manual_installation_on_linux

This command copies the default Graylog example configuration file to the designated server configuration directory (`/etc/graylog/server/server.conf`), providing a base for further customization and required settings.

```bash
sudo cp graylog.conf.example /etc/graylog/server/server.conf
```

--------------------------------

### Enable and Start OpenSearch System Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/ubuntu_installation

These commands manage the OpenSearch system service. They reload the systemd daemon, enable the service to start on boot, start the service immediately, and then check its current status.

```bash
sudo systemctl daemon-reload
sudo systemctl enable opensearch.service
sudo systemctl start opensearch.service
sudo systemctl status opensearch.service
```

--------------------------------

### Enable and Start OpenSearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/suse_installation

Reloads systemd daemon, enables OpenSearch to start on boot, starts the service immediately, and checks its current status.

```bash
sudo systemctl daemon-reload
sudo systemctl enable opensearch.service
sudo systemctl start opensearch.service
sudo systemctl status opensearch
```

--------------------------------

### Enable and Start Graylog Service on Systemd

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/ubuntu_installation

Reloads the systemd daemon, enables the Graylog server service to start on boot, and then immediately starts the service. The final command verifies that the `graylog-server.service` is active.

```Shell
sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl --type=service --state=active | grep graylog
```

--------------------------------

### Example Graylog Plugin Directory Structure

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/downloading_and_installing_graylog/graylog_oss_to_operations

This snippet illustrates the typical content of the Graylog plugin directory after installing the Operations plugin, showing various Graylog plugin JAR files alongside the newly installed enterprise plugin.

```Shell
plugin/
├── graylog-plugin-aws-4.0.1.jar
├── graylog-plugin-collector-4.0.1.jar
├── graylog-plugin-enterprise-4.0.1.jar
└── graylog-plugin-threatintel-4.0.1.jar
```

--------------------------------

### Enable and Start OpenSearch System Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/debian_installation

Reloads the systemd daemon, enables the OpenSearch service to start on boot, and immediately starts the OpenSearch service.

```bash
sudo systemctl daemon-reload
sudo systemctl enable opensearch.service
sudo systemctl start opensearch.service
```

--------------------------------

### Enable and Start OpenSearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/suse_installation

These commands reload the systemd daemon, enable the OpenSearch service to start automatically on boot, and then immediately start the OpenSearch service.

```bash
sudo systemctl daemon-reload
sudo systemctl enable opensearch.service
sudo systemctl start opensearch.service
```

--------------------------------

### Start Graylog Server Service (systemd)

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/installing_graylog_operations

Commands to start the Graylog server service using systemd on RedHat/CentOS/AlmaLinux/Rocky Linux and Debian/Ubuntu systems.

```Shell
sudo systemctl start graylog-server
```

--------------------------------

### Start Graylog Server

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/manual_installation_on_linux

These commands navigate to the Graylog server's binary directory and initiate the server process using the `graylogctl` script. Ensure proper permissions for the `node_id` file to allow the server to start successfully.

```bash
cd /usr/share/graylog-server/bin/
./graylogctl start
```

--------------------------------

### Start Graylog Server

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/manual_installation_on_linux

These commands navigate to the Graylog server's binary directory and initiate the server startup process using the 'graylogctl' script. Ensure proper permissions for the node_id file.

```shell
cd /usr/share/graylog-server/bin/
./graylogctl start
```

--------------------------------

### Start Graylog Server Process

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/manual_installation_on_linux

This command navigates to the Graylog server's binary directory and initiates the server process using the `graylogctl` script. It's the final step to bring the Graylog instance online.

```bash
cd /usr/share/graylog-server/bin/
./graylogctl start
```

--------------------------------

### Starting Graylog Server

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/manual_installation_on_linux

This command navigates to the Graylog binary directory and initiates the Graylog server process. Ensure necessary permissions are set for the server to write its node ID.

```Shell
cd bin/
./graylogctl start
```

--------------------------------

### Start Graylog Server via graylogctl

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/manual_installation_on_linux

Navigate to the `bin` directory and start the Graylog server using the `graylogctl` script. This command initiates the Graylog service.

```Shell
cd bin/$ ./graylogctl start
```

--------------------------------

### Graylog Forwarder Agent Health Status API Response Example

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/getting_in_log_data/forwarder

Example JSON response from the GET /api/health endpoint of the Graylog Forwarder Agent REST API, showing the overall health, input status, and upstream connectivity.

```JSON
{
	"healthy" : true ,
	"inputs" : {
		"healthy" : true ,
		"running" : 2 ,
		"failed" : 0 ,
		"not running" : 0
		},
	"upstream" : {
		"healthy" : true
	}
}
```

--------------------------------

### Manually Start Graylog Server Service

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/installing_graylog_operations

Commands to manually start the Graylog server service on various Linux distributions, depending on their init system (SysV or systemd). These commands initiate the Graylog service immediately after execution.

```bash
sudo service graylog-server start
```

```bash
sudo systemctl start graylog-server
```

--------------------------------

### Copy Graylog Server Example Configuration

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/manual_installation_on_linux

This command copies the example Graylog server configuration file to the `/etc/graylog/server/` directory, preparing it for customization.

```Shell
# cp graylog.conf.example /etc/graylog/server/server.conf
```

--------------------------------

### Configure and Start Graylog Sidecar Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/getting_in_log_data/install_sidecar_on_linux

After installation, this snippet provides commands to edit the Graylog Sidecar configuration file (sidecar.yml) to set server_url and server_api_token, which are the only parameters requiring manual configuration. It then installs Sidecar as a system service and includes an example command to start the service on Ubuntu 14.04 using Upstart. These commands should be executed on the remote machine where log data will be collected.

```bash
sudo vi /etc/graylog/sidecar/sidecar.yml

sudo graylog-sidecar -service install

# Ubuntu 14.04 with Upstart
sudo start graylog-sidecar
```

--------------------------------

### Graylog Forwarder API Health Status Response

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/getting_in_log_data/forwarder

Example JSON response from the GET /api/health endpoint, showing the overall health of the forwarder, its inputs, and upstream connection.

```JSON
{
    "healthy" : true ,
    "inputs" : {
        "healthy" : true ,
        "running" : 2 ,
        "failed" : 0 ,
        "not running" : 0
        },
    "upstream" : {
    "healthy" : true
    }
}
```

--------------------------------

### Start Graylog Server using graylogctl

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/downloading_and_installing_graylog/manual_installation_on_linux

This command navigates to the Graylog binary directory and initiates the Graylog server process using the `graylogctl` script. Ensure proper permissions for writing the `node_id` file.

```Shell
cd bin/$ ./graylogctl start
```

--------------------------------

### Set Up Graylog Web Development Environment

Source: https://go2docs.graylog.org/6-1/home.htm/6-1/what_more_can_graylog_do_for_me/plugins

This snippet provides the commands to set up and start the development web server for the Graylog web interface. It includes steps for navigating to the correct directory, installing dependencies using yarn, starting the development server, and opening the application in a browser.

```bash
cd graylog2-server/graylog2-web-interface
yarn install
[...]
yarn start
[...]
open http://localhost:8080
```

--------------------------------

### Start Graylog Server Service (systemd)

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/operating_system_packages

Command to manually start the Graylog server service using systemd, applicable for RHEL 7-9 and compatible operating systems.

```Shell
sudo systemctl start graylog-server
```

--------------------------------

### Graylog Forwarder Docker Compose Environment Variables

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/getting_in_log_data/forwarder_installation

Example .env file providing configuration options for the Graylog Forwarder Docker Compose setup, including the ingest hostname.

```dotenv
# See the Graylog Forwarder documentation for all available configuration options.
# https://go2docs.graylog.org/4-x/getting_in_log_data/forwarder_configuration_options.html

# The Graylog Forwarder ingest hostname (eg. Graylog for on-premise or
# ingest-<your-account>.graylog.cloud for Cloud). Provided in the Forwarder
```

--------------------------------

### Enable Graylog Server to Start Automatically on Boot

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/installing_graylog_operations

Commands to configure the Graylog server service to automatically start when the operating system boots up. This snippet includes commands for both SysV Init and systemd init systems, applicable to various Linux distributions.

```Shell
sudo update-rc.dgraylog-server defaults95 10
```

```Shell
sudo systemctl enable graylog-server
```

--------------------------------

### Steps to Contribute a Graylog Plugin

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/what_more_can_graylog_do_for_me/graylog_marketplace

Detailed instructions for developers on how to prepare and submit a Graylog plugin to the Marketplace, including GitHub repository setup, required files, and release creation.

```Instructions
1. Create a GitHub repository for your plugin.
2. Include a README and a LICENSE file in the repository.
3. Push all your code to the repository.
4. Create a GitHub release and give it the name of the plugin version. For example `0.1`. The Marketplace will always show and link the latest version. You can upload as many release artifacts as you want here. For example the `.jar` file together with `DEB` and `RPM` files. The Marketplace will link to the detail page of a release for downloads.
5. Submit the repository to the Marketplace.
```

--------------------------------

### Start Graylog Service on CentOS 7/8 (systemd)

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/operating_system_packages

Command to start the Graylog server service on CentOS 7 and 8 systems using the systemd init system.

```bash
sudo systemctl start graylog-server
```

--------------------------------

### Run Graylog Forwarder Docker Container Example

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/getting_in_log_data/forwarder_installation

This example command demonstrates how to run the Graylog Forwarder Docker container, passing required environment variables for server hostname and API token, and mounting a TLS certificate file as a volume for secure communication.

```shell
docker run -e GRAYLOG_FORWARDER_SERVER_HOSTNAME=ingest.<SERVER NAME> -e GRAYLOG_FORWARDER_GRPC_API_TOKEN=<INSERT_API_TOKEN_HERE> -v /path/to/cert/cert.pem:/etc/graylog/forwarder/cert.pem graylog/graylog-forwarder:<release-version>
```

--------------------------------

### Start Graylog Server Service on Linux

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/installing_graylog_operations

Commands to manually start the Graylog server service on various Linux distributions. This snippet provides commands for both SysV Init and systemd init systems, covering different CentOS, Debian, and Ubuntu versions.

```Shell
sudo service graylog-server start
```

```Shell
sudo systemctl start graylog-server
```

--------------------------------

### Enable and Start Graylog Server Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/ubuntu_installation

Commands to reload the systemd daemon, enable the Graylog server service to start automatically on boot, start the service immediately, and verify its active status.

```bash
sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl --type=service --state=active | grep graylog
```

--------------------------------

### Graylog Configuration File Syntax Examples

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/setting_up_graylog/initial_configuration_settings

Illustrative examples demonstrating the syntax for defining properties in Graylog configuration files, including how whitespace is handled and how to add comments. This helps in understanding the basic structure of entries.

```Configuration
propertyName=propertyValue
propertyName:propertyValue
name=Stephen
name = Stephen
# This is a comment
! Another comment
```

--------------------------------

### Graylog Forwarder API Inputs List Response

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/getting_in_log_data/forwarder

Example JSON response from the GET /api/inputs endpoint, providing a list of active inputs running on the forwarder, including their IDs and titles.

```JSON
{
    "inputs" : [
        {
            "id" : "5fc91564d44bfd2000249e8c" ,
            "title" : "Random"
        },
        {
            "id" : "5fc91550d44bfd2000249e74" ,
            "title" : "Beats"
        }
    ]
}
```

--------------------------------

### Start MongoDB Service on SUSE

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/suse_installation

Reloads the systemd daemon and starts the MongoDB service (`mongod.service`), making the database instance available for immediate use on SUSE.

```Shell
sudo systemctl daemon-reload
sudo systemctl start mongod.service
```

--------------------------------

### Enable and Start MongoDB Service

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/debian_installation

Reloads systemd daemon, enables MongoDB to start automatically on boot, restarts the `mongod` service, and verifies its active status to ensure it's running correctly.

```bash
sudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl restart mongod.service
sudo systemctl --type=service --state=active | grep mongod
```

--------------------------------

### Start Graylog Server via graylogctl

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/downloading_and_installing_graylog/manual_installation_on_linux

This command navigates to the Graylog binary directory and starts the Graylog server using the `graylogctl` script. Ensure proper permissions for the server to write its `node_id` file.

```Shell
cd bin/$ ./graylogctl start
```

--------------------------------

### Start Graylog Forwarder Binary

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/getting_in_log_data/forwarder

Instructions to start the Graylog forwarder when using the binaries. This command executes the startup script, specifying the configuration file to use for the forwarder's operation.

```bash
./bin/graylog-forwarder run --configfile forwarder.conf.
```

--------------------------------

### Start Graylog Service on CentOS 6 (SysV Init)

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/operating_system_packages

Command to start the Graylog server service on CentOS 6 systems using the SysV Init system.

```bash
sudo service graylog-server start
```

--------------------------------

### Copy Graylog Example Configuration File

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/manual_installation_on_linux

This command copies the provided example Graylog configuration file to the designated server configuration directory. This file serves as a template for customizing Graylog's behavior.

```bash
sudo cp graylog.conf.example /etc/graylog/server/server.conf
```

--------------------------------

### Start MongoDB Service on SUSE

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/suse_installation

Reloads the systemd daemon and starts the MongoDB service (`mongod.service`) immediately after installation, making it active.

```bash
sudo systemctl daemon-reload
sudo systemctl start mongod.service
```

--------------------------------

### Install and Start MongoDB Service on CentOS

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/downloading_and_installing_graylog/centos_installation

These commands install the latest MongoDB release and then manage its service. They reload the systemd daemon, enable MongoDB to start on boot, start the service immediately, and verify its active status, ensuring MongoDB is operational.

```bash
sudo yum install mongodb-org
```

```bash
sudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl start mongod.service
sudo systemctl --type=service --state=active | grep mongod
```

--------------------------------

### Start Graylog Forwarder using Binaries

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/getting_in_log_data/forwarder

This command is used to start the Graylog Forwarder when using the forwarder binaries. It executes the startup script and specifies the path to the `forwarder.conf` file, which contains all necessary environment-specific configurations.

```Shell
./bin/graylog-forwarder run --configfile forwarder.conf
```

--------------------------------

### Run Graylog Forwarder Docker Container Example

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/Getting_in_Log_Data/Forwarder_Installation

Example command to run the Graylog Forwarder Docker container, setting environment variables for server hostname and API token, and mounting a TLS certificate volume for secure communication.

```Shell
docker run -e GRAYLOG_FORWARDER_SERVER_HOSTNAME=ingest.<SERVER NAME> -e GRAYLOG_FORWARDER_GRPC_API_TOKEN=<INSERT_API_TOKEN_HERE> -v /path/to/cert/cert.pem:/etc/graylog/forwarder/cert.pem graylog/graylog-forwarder:<release-version>
```

--------------------------------

### Start Graylog Server Service on Debian/Ubuntu with systemd

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/operating_system_packages

This command starts the Graylog server service using systemd. It is applicable for Debian 10 & 11, and Ubuntu 16.04, 18.04, 20.04 systems.

```Shell
sudo systemctl start graylog-server
```

--------------------------------

### Install and Start Graylog Sidecar Service on Windows

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/getting_in_log_data/graylog_sidecar

These commands are used to install and start the Graylog Sidecar service on a Windows machine. They must be executed from an administrator command prompt. For PowerShell, prefix commands with &.

```Batch
"C:\\Program Files\\graylog\\sidecar\\graylog-sidecar.exe" -service install
"C:\\Program Files\\graylog\\sidecar\\graylog-sidecar.exe" -service start
```

--------------------------------

### Set Up Graylog Web Plugin Development Environment

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/what_more_can_graylog_do_for_me/plugins

This snippet provides the commands to initialize and start the Graylog web interface development server. It assumes Node.js and Yarn are already installed. The `yarn install` command fetches dependencies, and `yarn start` launches the development server, typically opening a browser to `http://localhost:8080`.

```Shell
cd graylog2-server/graylog2-web-interface
yarn install
yarn start
open http://localhost:8080
```

--------------------------------

### Generate SHA256 Hash for Graylog Root Password

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/installing_graylog_operations

Command to generate the SHA256 hash for the Graylog root password. This hash is a mandatory configuration setting (`root_password_sha2`) required in the `/etc/graylog/server/server.conf` file for Graylog to start.

```Shell
echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
```

--------------------------------

### Required SUSE System Patterns for Graylog Minimal Setup

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/suse_installation

This snippet lists the essential system patterns that must be installed on SUSE Linux Enterprise Server for a minimal Graylog setup, as referenced in the SUSE 15 SP3 Deployment Guide.

```Text
- Base System
- Minimal System (Appliances)
- YaST configuration packages
```

--------------------------------

### Example OpenSearch Minimum Configuration File

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/planning_your_deployment/opensearch_on_red_hat__rpm_yum_

Provides a basic `opensearch.yml` configuration example, including essential settings like disabling auto-index creation, defining cluster name, discovery hosts, initial master nodes, node name, data/log paths, and temporarily disabling security for initial setup.

```yaml
action.auto_create_index: false
cluster.name: test-cluster1
discovery.seed_hosts: node2,node3
cluster.initial_master_nodes: node1,node2,node3
node.name: node1
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch
plugins.security.disabled: true
```

--------------------------------

### Install and Start Graylog Sidecar Service on Windows

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/getting_in_log_data/graylog_sidecar

These command-line instructions are used to install and start the Graylog Sidecar service on a Windows machine. The commands execute the `graylog-sidecar.exe` located in the program files directory with the `-service install` and `-service start` arguments respectively. Users should open a command prompt with administrator rights and prefix commands with `&` if using PowerShell.

```Command Line
"C:\Program Files\graylog\sidecar\graylog-sidecar.exe" -service install
"C:\Program Files\graylog\sidecar\graylog-sidecar.exe" -service start
```

--------------------------------

### Set up Graylog Web Plugin Development Environment

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/what_more_can_graylog_do_for_me/plugins

This snippet provides the commands to set up and start the Graylog web interface development server. It assumes Node.js and Yarn are already installed. The commands navigate to the web interface directory, install dependencies, start the development server, and open it in a browser.

```Shell
cd graylog2-server/graylog2-web-interface
yarn install
[...]
yarn start
[...]
open http://localhost:8080
```

--------------------------------

### Start and Verify Graylog Server Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/debian_installation

These commands reload the systemd daemon, enable Graylog to start on boot, start the service, and then verify its active status, ensuring the Graylog server is running correctly after installation and configuration.

```bash
sudo systemctl daemon-reload
sudo systemctl enable graylog-server
sudo systemctl start graylog-server
sudo systemctl --type=service --state=active | grep graylog
```

--------------------------------

### Enable and Start Elasticsearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/suse_installation

Reloads systemd daemon, enables Elasticsearch to start on boot, and starts the service immediately.

```bash
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service
```

--------------------------------

### Install OpenSearch with Initial Admin Password

Source: https://go2docs.graylog.org/6-1/home.htm/current/downloading_and_installing_graylog/debian_installation_os

Installs the OpenSearch package, requiring the `OPENSEARCH_INITIAL_ADMIN_PASSWORD` environment variable to be set for initial setup. Includes examples for installing the latest or a specific version.

```bash
sudo OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get -y install opensearch
```

```bash
sudo OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get -y install opensearch=2.15.0
```

--------------------------------

### Install Graylog Open Server

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/ubuntu_installation

Commands to download the Graylog 5.2 repository package and install the `graylog-server` component using `wget`, `dpkg`, and `apt-get`.

```bash
wget https://packages.graylog2.org/repo/packages/graylog-5.2-repository_latest.deb
sudo dpkg -i graylog-5.2-repository_latest.deb
sudo apt-get update && sudo apt-get install graylog-server
```

--------------------------------

### Required SUSE System Patterns for Graylog

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/suse_installation

Lists the essential SUSE system patterns that must be installed for a minimal Graylog setup, as recommended by the SUSE 15 SP3 Deployment Guide.

```text
- Base System
- Minimal System (Appliances)
- YaST configuration packages
```

--------------------------------

### Steps to Contribute a Graylog Content Pack

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/what_more_can_graylog_do_for_me/graylog_marketplace

Instructions for sharing Graylog content packs on the Marketplace, covering the process of downloading the content pack JSON, setting up a GitHub repository, and submitting it.

```Instructions
1. Download a Graylog content pack from the Graylog Web Interface and save the generated JSON in a file called `content_pack.json`.
2. Create a GitHub repository for your content pack.
3. Include a README and a LICENSE file in the repository.
4. Include the `content_pack.json` file in the root of your GitHub repository.
5. Submit the repository to the Marketplace.
```

--------------------------------

### Install Graylog Open Server

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/ubuntu_installation

Commands to download the Graylog 5.0 repository package, install it using dpkg, update the apt-get package list, and then install the Graylog server.

```shell
wget https://packages.graylog2.org/repo/packages/graylog-5.0-repository_latest.deb
sudo dpkg -i graylog-5.0-repository_latest.deb
sudo apt-get update && sudo apt-get install graylog-server
```

--------------------------------

### Start Graylog Forwarder Service (DEB)

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/getting_in_log_data/forwarder_installation

This command starts the Graylog Forwarder service using 'systemctl' after installation and configuration are complete.

```bash
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Copy Graylog Server Example Configuration

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/manual_installation_on_linux

This command copies the default Graylog example configuration file from the extracted server directory to the designated configuration directory, '/etc/graylog/server/', where it can be customized.

```shell
sudo cp graylog.conf.example /etc/graylog/server/server.conf
```

--------------------------------

### Start and Enable MongoDB Service

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/downloading_and_installing_graylog/centos_installation

Reloads the systemd daemon, enables the MongoDB service to start on boot, starts it immediately, and verifies its active status.

```Shell
sudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl start mongod.service
sudo systemctl --type=service --state=active | grep mongod
```

--------------------------------

### Enable and Start Graylog Server Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/suse_installation

Reloads systemd daemon, enables the Graylog server service to start automatically on boot, and immediately starts the service.

```Shell
sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
```

--------------------------------

### Start Graylog Forwarder Binary

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/getting_in_log_data/forwarder

Command to start the Graylog Forwarder when using the forwarder binaries. This command executes the startup script and specifies the configuration file.

```shell
./bin/graylog-forwarder run --configfile
   forwarder.conf.
```

--------------------------------

### Set Up Graylog Web Development Environment

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/what_more_can_graylog_do_for_me/plugins

This snippet provides commands to set up the Graylog web interface development environment. It navigates to the web interface directory, installs dependencies using yarn, starts the development server, and opens the application in a browser. A running Graylog server is required for full functionality.

```Shell
cd graylog2-server/graylog2-web-interface
yarn install
[...]
yarn start
[...]
open http://localhost:8080
```

--------------------------------

### Enable and Start Elasticsearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/suse_installation

These commands reload the systemd daemon, enable the Elasticsearch service to start automatically on system boot, and immediately start the service.

```Shell
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service
```

--------------------------------

### Install Prerequisites for Graylog on Debian

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/debian_installation

Installs essential packages required for Graylog setup on Debian Linux, including `apt-transport-https`, `openjdk-11-jre-headless`, `uuid-runtime`, `pwgen`, `dirmngr`, `gnupg`, and `wget`.

```bash
sudo apt update && sudo apt upgrade
sudo apt install apt-transport-https openjdk-11-jre-headless uuid-runtime pwgen dirmngr gnupg wget
```

--------------------------------

### Graylog Forwarder Docker Compose .env Configuration

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/getting_in_log_data/forwarder_installation

Example '.env' file for configuring the Graylog Forwarder with Docker Compose. It defines essential variables like the server hostname, API token, and TLS enablement. These variables are consumed by a Docker Compose setup.

```dotenv
# See the Graylog Forwarder documentation for all available configuration options.
# https://go2docs.graylog.org/4-2/getting_in_log_data/forwarder_configuration_options.html

# The Graylog Forwarder ingest hostname (eg. Graylog for on-premise or
# ingest-<your-account>.graylog.cloud for Cloud). Provided in the Forwarder
# Setup Wizard in Graylog. [required]
GRAYLOG_FORWARDER_SERVER_HOSTNAME=""

# The API Token for authenticating the forwarder. Provided in the Forwarder
# Setup Wizard in Graylog. [required]
GRAYLOG_FORWARDER_GRPC_API_TOKEN=""

# Enables TLS for forwarder communication. Always enable for production use.
GRAYLOG_FORWARDER_GRPC_ENABLE_TLS="true"
```

--------------------------------

### Set up Graylog Web Plugin Development Environment

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/what_more_can_graylog_do_for_me/plugins

This snippet provides the commands to set up and start the Graylog web interface development server. It assumes Node.js and Yarn are already installed. The commands navigate to the web interface directory, install dependencies, start the development server, and open it in a browser for local development.

```Shell
cd graylog2-server/graylog2-web-interface
yarn install
[...]
yarn start
[...]
open http://localhost:8080
```

--------------------------------

### Install Graylog Enterprise on RHEL/CentOS (RPM)

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/installing_graylog_operations

Commands to install Graylog Enterprise on RPM-based systems like CentOS or Red Hat using YUM/DNF. This involves adding the Graylog repository and installing the `graylog-enterprise` package.

```Shell
sudo rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-<server_version>-repository_latest.rpm
sudo yum install graylog-enterprise
```

--------------------------------

### List Available OpenSearch Versions

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/ubuntu_installation

Lists all available versions of the OpenSearch package from the configured APT repositories.

```bash
sudo apt list -a opensearch
```

--------------------------------

### Install Graylog Enterprise on Debian/Ubuntu (APT)

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/installing_graylog_operations

Commands to install Graylog Enterprise on Debian or Ubuntu systems using APT. This includes adding the Graylog repository, updating package lists, and installing the `graylog-enterprise` package.

```Shell
sudo apt-get install apt-transport-https
wget https://packages.graylog2.org/repo/packages/graylog-<server_version>-repository_latest.deb
sudo dpkg -i graylog-<server_version>-repository_latest.deb
sudo apt-get update
sudo apt-get install graylog-enterprise
```

--------------------------------

### Install Graylog Repository and Server

Source: https://go2docs.graylog.org/6-1/home.htm/6-1/downloading_and_installing_graylog/ubuntu_installation_os

Installs the Graylog repository configuration and then proceeds to install either Graylog Open or Graylog Enterprise server packages using `apt-get`. This sets up the core Graylog application.

```Shell
wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
sudo dpkg -i graylog-6.1-repository_latest.deb
sudo apt-get update
sudo apt-get install graylog-server
```

```Shell
wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
sudo dpkg -i graylog-6.1-repository_latest.deb
sudo apt-get update
sudo apt-get install graylog-enterprise
```

--------------------------------

### Install Graylog Enterprise on CentOS/Red Hat (RPM)

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/installing_graylog_operations

Commands to install Graylog Enterprise on CentOS or Red Hat systems using RPM/YUM/DNF. This involves adding the Graylog package repository and then installing the `graylog-enterprise` package.

```Shell
sudo rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-<server_version>-repository_latest.rpm
sudo yum install graylog-enterprise
```

--------------------------------

### Start Graylog Forwarder Service (RPM)

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/getting_in_log_data/forwarder_installation

This command starts the Graylog Forwarder service using 'systemctl' after installation and configuration are complete.

```bash
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Install Prerequisites for Graylog on Debian

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/downloading_and_installing_graylog/debian_installation

Installs essential packages like `apt-transport-https`, `openjdk-11-jre-headless`, `uuid-runtime`, `pwgen`, `dirmngr`, `gnupg`, and `wget` required for a minimal server setup before installing Graylog components.

```shell
sudo apt update && sudo apt upgrade
sudo apt install apt-transport-https openjdk-11-jre-headless uuid-runtime pwgen dirmngr gnupg wget
```

--------------------------------

### Install Graylog Open Repository and Server

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/debian_installation

These commands download the Graylog 5.1 repository package, install it using `dpkg`, and then update the package lists before installing the `graylog-server` package. This sets up the core Graylog Open instance.

```bash
wget https://packages.graylog2.org/repo/packages/graylog-5.1-repository_latest.deb
sudo dpkg -i graylog-5.1-repository_latest.deb
sudo apt-get update && sudo apt-get install graylog-server
```

--------------------------------

### Example Graylog Plugin Directory Structure

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/graylog_open_to_operations

Shows an example of the Graylog plugin directory structure after installing various Graylog Operations plugins (AWS, Collector, Enterprise, ThreatIntel JARs). This illustrates where plugin JAR files should reside.

```Shell
plugin/
├── graylog-plugin-aws-4.0.1.jar
├── graylog-plugin-collector-4.0.1.jar
├── graylog-plugin-enterprise-4.0.1.jar
└── graylog-plugin-threatintel-4.0.1.jar
```

--------------------------------

### Install Graylog Forwarder via DEB Package

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/getting_in_log_data/forwarder_installation

Provides a sequence of shell commands to install the Graylog Forwarder on Debian/Ubuntu-based systems. It includes steps for installing Java, downloading the DEB package, installing it, updating package lists, and starting the forwarder service.

```Shell
sudo apt-get install apt-transport-https openjdk-17-jdk-headless
wget https://downloads.graylog.org/releases/cloud/forwarder/4.10/graylog-forwarder_4.10-1_all.deb
sudo dpkg -i graylog-forwarder_4.10-1_all.deb
sudo apt-get update
```

```Shell
sudo apt-get install graylog-forwarder
```

```Shell
sudo vi /etc/graylog/forwarder/forwarder.conf
```

```Shell
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Enable Graylog Server Service to Start at Boot on Debian/Ubuntu with systemd

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/operating_system_packages

This command configures the Graylog server service to automatically start when the operating system boots. It is applicable for Debian 10 & 11, and Ubuntu 16.04, 18.04, 20.04 systems.

```Shell
sudo systemctl enable graylog-server
```

--------------------------------

### Install Graylog Forwarder via RPM Package

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/getting_in_log_data/forwarder_installation

This snippet provides the commands to install the Graylog Forwarder on Red Hat-based systems. It includes steps for installing the Graylog repository configuration, installing the forwarder package using yum, and then configuring and starting the service.

```plaintext
https://downloads.graylog.org/releases/cloud/forwarder/4.10/graylog-forwarder-4.10-1.noarch.rpm
```

```shell
sudo yum install graylog-forwarder
```

```shell
sudo vi /etc/graylog/forwarder/forwarder.conf
```

```shell
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Copy Graylog Example Configuration File

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/downloading_and_installing_graylog/manual_installation_on_linux

This command copies the example Graylog configuration file to its standard location, `/etc/graylog/server/server.conf`. This file will then be edited to configure essential server parameters for Graylog's operation.

```Shell
# cp graylog.conf.example /etc/graylog/server/server.conf
```

--------------------------------

### Bootstrap Graylog Meta Project

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/what_more_can_graylog_do_for_me/plugins

This command initializes the Graylog meta project in the current working directory. It sets up the foundational development environment, including the Graylog server and repositories for plugins.

```shell
graylog-project bootstrap github://Graylog2/graylog-project.git
```

--------------------------------

### Enable and Start MongoDB Service on Debian

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/debian_installation

Configures the MongoDB service to start automatically on system boot, reloads systemd daemon, starts the service, and verifies its active status.

```shell
sudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl restart mongod.service
sudo systemctl --type=service --state=active | grep mongod
```

--------------------------------

### Graylog Forwarder API Inputs List Response Example

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/getting_in_log_data/forwarder

Example JSON response from the Graylog Forwarder Agent's `/api/inputs` endpoint, providing a list of inputs currently running on the forwarder, including their IDs and titles.

```JSON
{
    "inputs" : [
        {
            "id" : "5fc91564d44bfd2000249e8c" ,
            "title" : "Random"
        },
        {
            "id" : "5fc91550d44bfd2000249e74" ,
            "title" : "Beats"
        }
    ]
}
```

--------------------------------

### Install Graylog Forwarder via RPM Package

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/getting_in_log_data/forwarder_installation

Provides a sequence of shell commands to install the Graylog Forwarder on Red Hat/CentOS-based systems. It includes steps for installing the forwarder package using yum, configuring the service, and starting it.

```Shell
sudo yum install graylog-forwarder
```

```Shell
sudo vi /etc/graylog/forwarder/forwarder.conf
```

```Shell
sudo systemctl start graylog-forwarder.service
```

--------------------------------

### Install Graylog Enterprise on CentOS/Red Hat via RPM/YUM

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/installing_graylog_operations

Commands to install Graylog Enterprise on CentOS or Red Hat systems using rpm and yum/dnf. This involves adding the Graylog repository and then installing the graylog-enterprise package.

```bash
sudo rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-<server_version>-repository_latest.rpm
sudo yum install graylog-enterprise
```

--------------------------------

### Graylog Forwarder Service Started Log Message

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/getting_in_log_data/forwarder

The console output message indicating that the Graylog Forwarder service has successfully started and is operational.

```Plaintext
INFO: Forwarder Service started successfully.
```

--------------------------------

### Install Graylog Enterprise on Debian/Ubuntu (APT)

Source: https://go2docs.graylog.org/6-1/home.htm/4-2/downloading_and_installing_graylog/installing_graylog_operations

Commands to install Graylog Enterprise on Debian or Ubuntu systems using APT. This process involves adding the Graylog package repository, updating the package list, and then installing the `graylog-enterprise` package.

```Shell
sudo apt-get install apt-transport-https
wget https://packages.graylog2.org/repo/packages/graylog-<server_version>-repository_latest.deb
sudo dpkg -i graylog-<server_version>-repository_latest.deb
sudo apt-get update
sudo apt-get install graylog-enterprise
```

--------------------------------

### Enable and Start OpenSearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/debian_installation

Reloads systemd daemon, enables OpenSearch to start automatically on boot, starts the service immediately, and checks its current status to confirm successful operation.

```shell
sudo systemctl daemon-reload
sudo systemctl enable opensearch.service
sudo systemctl start opensearch.service
sudo systemctl status opensearch
```

--------------------------------

### Install Graylog Open Repository and Server

Source: https://go2docs.graylog.org/6-1/home.htm/5-2/downloading_and_installing_graylog/debian_installation

These commands download the Graylog 5.2 repository package, install it using `dpkg`, update the system's package list, and then install the Graylog Open server package. This sets up the core Graylog server components.

```shell
wget https://packages.graylog2.org/repo/packages/graylog-5.2-repository_latest.deb
sudo dpkg -i graylog-5.2-repository_latest.deb
sudo apt-get update && sudo apt-get install graylog-server
```

--------------------------------

### Enable and Start Graylog Server Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/ubuntu_installation

Commands to reload the systemd daemon, enable the Graylog server service to start automatically on system boot, immediately start the service, and then verify its active status.

```shell
sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl --type=service --state=active | grep graylog
```

--------------------------------

### Start OpenSearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/6-1/downloading_and_installing_graylog/suse_installation_os

This command starts the OpenSearch service immediately, assuming it has been enabled previously or is being started manually.

```bash
sudo systemctl start opensearch
```

--------------------------------

### Enable and Verify MongoDB Service Startup

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/ubuntu_installation

Commands to reload systemd daemon, enable MongoDB to start on boot, restart the MongoDB service, and verify its active status.

```bash
sudo systemctl daemon-reload
sudo systemctl enable mongod.service
sudo systemctl restart mongod.service
sudo systemctl --type=service --state=active | grep mongod
```

--------------------------------

### Start Graylog Forwarder Binary and Verify Status

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/getting_in_log_data/forwarder

Instructions and the command to execute for starting the Graylog Forwarder when using the forwarder binaries. This snippet also includes the expected success message displayed in the console once the forwarder service has successfully started.

```bash
./bin/graylog-forwarder run --configfile forwarder.conf.
```

```plaintext
INFO: Forwarder Service started successfully.
```

--------------------------------

### Enable and Start Elasticsearch Service

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/downloading_and_installing_graylog/suse_installation

These commands reload the systemd daemon, enable the Elasticsearch service to start automatically on system boot, and then immediately start the Elasticsearch service.

```bash
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service
```

--------------------------------

### Enable and Start Graylog Server Service

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/downloading_and_installing_graylog/centos_installation

These commands reload the systemd daemon, enable the Graylog server service to start on boot, start the service immediately, and then verify its active status.

```Shell
sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl --type=service --state=active | grep graylog
```

--------------------------------

### Start MongoDB Service on SUSE

Source: https://go2docs.graylog.org/6-1/home.htm/current/downloading_and_installing_graylog/suse_installation_os

Starts the MongoDB database service immediately. This command initiates the `mongod` process, making the database available for connections.

```Shell
sudo systemctl start mongod.service
```

--------------------------------

### Create OpenSearch APT Repository Source List

Source: https://go2docs.graylog.org/6-1/home.htm/5-1/downloading_and_installing_graylog/ubuntu_installation

This command adds the OpenSearch 2.x APT repository to the system's sources list, allowing `apt` to find and install OpenSearch packages.

```Shell
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-2.x.list
```

--------------------------------

### Install Core Prerequisites for Graylog on Debian

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/debian_installation

Installs essential system packages required for a Graylog setup on Debian, including Java Runtime Environment, UUID tools, and network utilities.

```shell
sudo apt update && sudo apt upgrade
sudo apt install apt-transport-https openjdk-11-jre-headless uuid-runtime pwgen dirmngr gnupg wget
```

--------------------------------

### Enable and Start Graylog Server Service

Source: https://go2docs.graylog.org/6-1/home.htm/4-1/downloading_and_installing_graylog/centos_installation

These commands reload the systemd daemon, enable the Graylog server service to start on boot, start the service immediately, and then verify its active status.

```Shell
sudo systemctl daemon-reload
sudo systemctl enable graylog-server.service
sudo systemctl start graylog-server.service
sudo systemctl --type=service --state=active | grep graylog
```

--------------------------------

### Copy Graylog Example Configuration File

Source: https://go2docs.graylog.org/6-1/home.htm/4-3/downloading_and_installing_graylog/manual_installation_on_linux

This command copies the default Graylog server configuration file from the extracted archive to the standard system-wide configuration directory, `/etc/graylog/server/server.conf`, for further customization.

```Shell
# cp graylog.conf.example /etc/graylog/server/server.conf
```

--------------------------------

### Example OpenSearch Minimum Configuration File

Source: https://go2docs.graylog.org/6-1/home.htm/5-0/planning_your_deployment/opensearch_on_red_hat__rpm_yum_

A comprehensive example of a minimal `opensearch.yml` configuration file. It includes essential settings like disabling auto-index creation, defining cluster name, seed hosts for discovery, initial master nodes, node name, data/log paths, and disabling the security plugin for initial setup.

```yaml
action.auto_create_index: false
cluster.name: test-cluster1
discovery.seed_hosts: node2,node3
cluster.initial_master_nodes: node1,node2,node3
node.name: node1
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch
plugins.security.disabled: true
```

--------------------------------

### Install Java OpenJDK Headless on CentOS

Source: https://go2docs.graylog.org/6-1/home.htm/4-0/downloading_and_installing_graylog/centos_installation

Installs the headless OpenJDK Java package required for Graylog on a minimal CentOS server setup. Replace `<version_number>` with the desired Java version.

```Shell
sudo yum install java-<version_number>-openjdk-headless.x86_64
```
Tokens:
Raw