Graylog: Getting Started

How to Get Started with Graylog

👋 Welcome to the Stackhero documentation!

Stackhero offers a ready-to-use Graylog cloud solution that provides a host of benefits, including:

  • Unlimited and dedicated SMTP email server included.
  • Effortless updates with just a click.
  • Customizable domain name secured with HTTPS (for example, https://logs.your-company.com).
  • Optimal performance and robust security powered by a private and dedicated VM.

Save time and simplify your life: it only takes 5 minutes to try Stackhero's Graylog cloud hosting solution!

Creating a First Input in Graylog

An input is the endpoint where Graylog receives your logs. You can send logs using TCP or UDP. Additionally, Graylog can collect log entries from an API, a Kafka queue, a RabbitMQ server, and other methods.

In this example, we will create a raw UDP input. To begin, open the Graylog interface and navigate to "System" then "Inputs". Choose "Raw/Plaintext UDP" and click on "Launch new input". Configure your input with the following values and validate the form:

  1. Node: Select your node
  2. Title: RAW UDP
  3. Port: 5555

Next, open a terminal on your computer and send a UDP message to your Graylog server. Remember to replace XXXXXX with your service domain name:

  • On macOS: echo "Hello Graylog from UDP" | nc -u -w1 -c <XXXXXX>.stackhero-network.com 5555
  • On Linux: echo "Hello Graylog from UDP" | nc -u -w1 <XXXXXX>.stackhero-network.com 5555

After sending the message, return to Graylog and click on "Search". You should see your message 🎉

Congratulations, you have now sent your first message to Graylog! Feel free to create additional inputs and dashboards tailored to your needs. For further guidance, you might find Graylog's official documentation useful.

Graylog Code Examples

Several code examples are available in our Git repository. This repository offers practical implementations and additional customizations to help you get the most out of Graylog.

Send rsyslog Logs to Graylog Using TLS Encryption

If you have an rsyslog client and want to send logs securely to Graylog, follow these steps:

Do not activate any TLS option on Graylog's input. TLS will be managed directly by a reverse proxy on your instance so that Graylog does not handle it.

  1. Go to your Graylog service configuration in the Stackhero dashboard and enable "TLS encryption" for the Syslog TCP port 514.

  2. Update your rsyslog configuration as outlined below. Replace <XXXXXX>.stackhero-network.com with your instance hostname:

    # Define TLS CA certificate
global(
  DefaultNetstreamDriver="gtls"
  DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt"
)

# Send all logs to a remote server
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it becomes available again
# See https://www.rsyslog.com/doc/v8-stable/configuration/actions.html
# and https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html
*.* action(
  type="omfwd"
  target="<XXXXXX>.stackhero-network.com"
  port="514"
  protocol="tcp"
  KeepAlive="on"
  KeepAlive.Interval="30"
  StreamDriver="gtls"
  StreamDriverMode="1"
  StreamDriverAuthMode="x509/name"
  ResendLastMSGOnReconnect="on"
  queue.filename="fwdRule1"  # unique name prefix for spool files
  queue.type="LinkedList"
  queue.maxDiskSpace="256m"
  queue.saveOnShutdown="on"
  action.resumeRetryCount="-1"
  action.resumeInterval="30"
)

  3. Restart your rsyslog service and verify the configuration by sending a log using the command:

    logger This is a test

This completes the setup. You are now securely sending logs to Graylog using TLS encryption!

Handle Error "failed to parse field [XXXX] of type [YYYY]"

You might encounter an error such as:

org.opensearch.index.mapper.MapperParsingException: failed to parse field [time] of type [long] in document with id 'xxxx'

You can view this error in the logs provided in the Stackhero dashboard or in the Graylog admin panel under System > Overview > Indexer failures.

This error indicates that a log was sent with a value for the field time that does not match the expected type (in this case, a numeric value of type "long"). Graylog leverages the dynamic mapping feature of OpenSearch. When a log is sent for the first time, OpenSearch attempts to guess the field types. For example, if a log includes the field time with the numeric value 1234, OpenSearch defines it as a numeric field. If another log is sent with the field time set as "abcd", a string, OpenSearch will reject it because it expects a numeric value.

Remember that the field name time is used for illustration only. It can be any field name and type.

To resolve this issue, you need to redefine the type that OpenSearch expects. For more information, please refer to the official Graylog documentation.

Update the OpenSearch Mapping

Before proceeding, enable OpenSearch access in the Stackhero dashboard. Navigate to your Graylog service and click on the "Configure" button to activate OpenSearch access.

Be careful with these changes as incorrect configurations can block your OpenSearch cluster and potentially result in data loss. If you are uncertain, do not proceed.

  1. Define your new mapping. In this example, we redefine the field time to be of type string. You can find available types in the OpenSearch field datatypes documentation.

  2. Save the following content to a file named graylog-custom-mapping.json:

    {
  "template": "graylog_*",
  "mappings": {
    "message": {
      "properties": {
        "time": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}

  3. Post this file using the following curl command (replace <XXXXXX>.stackhero-network.com with your instance domain name):

    curl -u 'admin' -X PUT -d @'graylog-custom-mapping.json' -H 'Content-Type: application/json' 'https://<XXXXXX>.stackhero-network.com/opensearch/_template/graylog-custom-mapping?pretty'

    You should receive a response like:

    {
  "acknowledged": true
}

  4. Finally, verify that the mapping has been updated with this command (replace the domain as needed):

    curl -u 'admin' -X GET 'https://<XXXXXX>.stackhero-network.com/opensearch/graylog_deflector/_mapping?pretty'

Handle Error "Unable to write audit log entry"

If you see an error such as:

Unable to write audit log entry because there is no valid license

or

Not running cleanup for auditlog entries in MongoDB because there is no valid license

this occurs because Graylog Enterprise has been activated without a valid licence. If you have a licence, you can enter it in the Graylog interface. If you do not have a licence, simply disable Graylog Enterprise in the Stackhero dashboard.

Other articles for Graylog