Graylog

Connect Graylog so agents can check cluster health, list streams and index sets, search messages, and count them by field

Connect a Graylog cluster to let CloudThinker agents check cluster health, list your streams and index sets, search recent messages, and count messages grouped by a field such as source. The connection uses a REST API access token for a read-only Graylog user, and CloudThinker gives agents no way to change anything in Graylog.

Prerequisites

• A Graylog cluster that CloudThinker can reach over HTTPS from the internet, with a certificate from a trusted issuer. If a firewall guards it, or it must stay private, see Reaching private services.
• A Graylog admin who can create users and share streams.
• The streams you want agents to read. Agents see only what you share with the CloudThinker user.
• The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

Setup

1. Create a read-only user

   In Graylog, go to System → Users and Teams and create a user for CloudThinker, such as cloudthinker, with the Reader role. A dedicated user keeps CloudThinker’s access visible and easy to revoke.

2. Give the user read access to streams and index sets

   The Reader role alone grants no access to your logs. For each stream agents should read, go to Streams, click Share on the stream’s row, add the cloudthinker user with Viewer access, and click Save. Make sure the user can also read the index sets behind those streams.

   Skip this and the connection still tests as Connected, but agents find no streams. See Required permissions.

3. Create an API access token

   Still in System → Users and Teams, find the user, open More, and select Edit tokens. Enter a token name, set the TTL as an ISO 8601 duration (for example P90D for 90 days), and click Create Token. Copy the token now. Graylog doesn’t show it again.

4. Add the connection in CloudThinker

   Open More → Workspace settings → Connections, select Graylog, and fill in:

   • Graylog base URL: your Graylog web/API root, such as https://graylog.example.com:9000. Don’t add /api.
   • API token: the token you copied.
   • TLS certificate: leave it on Verify TLS certificate.

   Click Connect. CloudThinker reads your cluster status to check the token.

   Success state: the connection shows a Connected status with the message Graylog read-only connection verified (3 node(s)), counting the nodes it found.

   Then run the prompt in Verify the connection in a new chat. That’s what proves stream access.

Graylog tokens expire at their TTL, and Graylog’s default TTL is 30 days. When the token expires, the connection switches to Error and workspace admins get a notification (see When a connection breaks). Pick a TTL that matches your rotation schedule, set a reminder, and update the connection before the old token lapses.

Connection details

Field	Description	Example
Graylog base URL	The web/API root, with no /api, path, query, or credentials	https://graylog.example.com:9000
API token	REST API access token for the read-only user	From Edit tokens
TLS certificate	Verify TLS certificate (default). Skip TLS verification works only for a localhost address, never from CloudThinker Cloud	Verify TLS certificate

CloudThinker adds /api itself and rejects a URL that carries anything beyond the root. The token travels with every request, so:

• The URL must use https. Plain http is refused.
• Skip TLS verification is refused. Install a certificate from a trusted issuer instead. There’s no option to upload your own CA certificate.

Both rules are relaxed only for a localhost address, which never applies to a Graylog reached from CloudThinker Cloud.

Required permissions

Graylog splits read access across two layers. You need both.

Layer	What to grant	Why
Role	Reader on the CloudThinker user	Graylog’s read-only baseline; lets CloudThinker read cluster status
Streams and index sets	Read access to each stream (shared at Viewer) and its index set	Decides which logs agents can see. With nothing shared, the user sees no logs

No write permission is ever needed. The connection’s Allow writes switch ships off, and there’s no reason to turn it on: CloudThinker has no Graylog write action, so extra access only widens what a leaked token could do.

If agents report no streams on a cluster that has them, the user is missing stream access. Graylog answers with an empty list instead of an error, so it looks like an empty cluster.

Agent capabilities

Capability	What agents can do
Cluster health	Report node count, Graylog versions, and cluster health
Streams and index sets	List streams and index sets, and review routing, retention, and rotation
Log search	Search messages with a Graylog query over a time window and return a sample
Counts	Count messages grouped by one field to find the noisiest source, service, or error
Ingestion checks	Spot disabled streams and sources that stopped sending

Searches and counts default to the last 24 hours and reach back at most 30 days. Results return at most 100 rows or groups, and each request times out after 300 seconds at most. Agents tell you the window and limit they used, and say when a result was cut short.

Verify the connection

Ask CloudThinker in a new chat:

Run Graylog discovery and summarize cluster health, node count, and the streams and index sets this token can read

Expect the node count and health, then the streams and index sets you shared. An empty stream list usually means missing stream access, not an empty cluster.

Example prompts

Search Graylog for 5xx errors from api-gateway in the last 6 hours and show a sample
Count Graylog messages by source over the last 24 hours and flag any source that stopped sending
Which Graylog streams are disabled, and what retention does each index set use?

Troubleshooting

Graylog rejected the API token (401)

The token expired, was revoked, or was copied incompletely. Create a new one under System → Users and Teams → More → Edit tokens and update API token.

The token can't read the cluster status (403)

The user is missing the Reader role. Add it, then test the connection again.

Agents find no streams

The user has the Reader role but no shared streams, so Graylog returns an empty list. Share each stream with the user at Viewer access and make sure it can read the index sets.

Could not reach the Graylog API, or the endpoint is not Graylog

The base URL points at the wrong root or already contains /api, a proxy answered instead of Graylog, or nothing answered at all. Reconnect with the web/API root only, such as https://graylog.example.com:9000, and check that the host and port are reachable from CloudThinker. To test the URL and token yourself, run:

curl -u '<token>:token' https://graylog.example.com:9000/api/cluster

It should return JSON with one entry per node. That’s the same call CloudThinker makes.

HTTPS required, or TLS verification can't be disabled

CloudThinker refuses plain http and Skip TLS verification for a remote Graylog, because either would expose the token. Serve Graylog over HTTPS with a trusted certificate and keep Verify TLS certificate on.

Results look cut short, or Graylog returned 429

The query hit the 100-row limit, timed out, or Graylog (or a proxy) rate-limited it. A timed-out search has an unknown match count. Narrow the query, shorten the window, or group by a more specific field.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Writes don’t apply: CloudThinker has no Graylog write action, so the connection is read-only whatever the token allows. Use the least-privileged user you can, as in Required permissions.
• Share only the streams you want read: stream access, not the role, decides which logs agents see.
• Track the token TTL: an expired token puts the connection in Error until you paste a new one. Rotate it on schedule and update the connection.

Related

Elasticsearch

Connect Elasticsearch indices and clusters.

Resolve overview

Use Graylog logs when CloudThinker investigates an incident.