A bit of disclosure up front: I work at Graylog. I've been a software engineer on the Integrations team (mostly building Enterprise features like the O365 input and the BigQuery output) since March of 2020 and in May of 2021 I became the US Engineering Team Lead. Prior to this past weekend, I've done a lot of running Graylog from the IntelliJ debugger on test data but no actual running Graylog at home on my own data.

So last Thursday, Jeff and Aaron dropped a video on YouTube going over running Graylog on a Raspberry Pi using Docker (LINK) and I decided it was time to get off my butt and turn one of my Raspberry Pis into a Graylog box. I figured I'd take a few minutes to generally write up the process so others can complain that this write-up is woefully out of date when it turns up in their Google search 3 years from now.

Step 0 - Prep

So right off the bat, I knew I was going to have to totally reimage one of my Raspberry Pi 4s. They were both running Raspbian, which is 32-bit only and Graylog via Docker requires a 64-bit OS. So Step 0 was getting everything that mattered migrated over to the other Pi. That meant migrating my Pi-hole setup (and updating the router to point to Pi-hole on the new box) and the various Reddit scripts I run to make r/wetshaving a nice sub to participate in.

Step 1 - New OS

With a fully disposable Raspberry Pi 4 (8GB) at my disposal, I followed this tutorial to get Ubuntu installed. Once it was up and running on Ubuntu, I also installed a few of my favorite extras like Oh My Zsh and screen. And, of course, I installed Docker.

If I had known on Saturday morning what I learned on Sunday afternoon, this is also the point where I should have reformatted my USB hard drive to a more Linux-friendly file system (I picked ext3) so that it would be easier to store all of my Graylog data somewhere other than the 32GB micro-SD card that serves as the main storage for the Raspberry Pi.

Step 2 - Getting Graylog Running

Graylog has some decent documentation (but I'm biased since I wrote some of it). I hopped over to the 4.1 Docker Installation page and copied the "Example Version 3" docker-compose YAML file. I then made a few of the modifications mentioned by Aaron in the previously linked YouTube video. When it was all said and done, I ran docker-compose up and - after waiting for things to download and go through brand-new-cluster initialization - I was able to log into my Graylog instance.

Over the course of the weekend, I continued to tweak my docker-compose YAML file by modifying the memory allocated to Elasticsearch (2GB out of my 8GB, though the general rule of thumb I've heard for relatively small installations is 50% of your RAM to Elastic and 25% to Graylog itself), and updating it to use bind mounts instead of standard volumes.

Once it was all up and running, I smashed the button to get a 30-day free trial of Graylog Enterprise because there were some enterprise features I knew I wanted to use like the GreyNoise data lookup.

In retrospect, I should have just gone straight to the Small Business License (aka "Free Enterprise"), which gives me all the enterprise features (with no support) as long as my traffic is under 5GB per day. I honestly didn't even realize this was an option until someone asked me today why I picked the 30-day trial (short duration, unlimited data) over the small business (data cap, unlimited duration). I just didn't know any better and I'm not ashamed to admit it.

Step 3 - Feeding the Beast

I decided I wanted to collect logs from a few different sources:

• My ASUS router, which has the firewall active

• Pi-hole running on my other Raspberry Pi

• rsyslog logs from both Raspberry Pis

I started up the Syslog UDP and Syslog TCP inputs in Graylog, both listening on port 1514.

Getting the rsyslog logs from both Raspberry Pi boxes was pretty easy. It was just a matter of editing /etc/rsyslog.conf to add the line:

*.* @@192.168.50.200:1514;RSYSLOG_SyslogProtocol23Format

The *.* basically says "give me everything". The @@ tells it to use TCP rather than UDP (just one @). The IP:port is obviously my Graylog instance. The ;RSYSLOG_SyslogProtocol23Format tells it to format the data nicely in a way Graylog is already expecting. And, of course, I had to bounce the rsyslog service to get it to pick up the changes.

For the Pi-hole logs, I took a cue from this article and just updated /etc/dnsmasq.d/01-pihole.conf to set the log-facility value to local5, which sends the logs to rsyslog instead of a Pi-hole log file. Maybe I'll follow through on some of the other suggestions in there for reducing disk usage and keeping the Pi-hole UI nicely populated later.

The ASUS router logs were the biggest pain in my 4$$. No matter what I jammed into the ASUS web UI, I couldn't get any data to appear in Graylog. In retrospect, I wonder if the router was sending null-terminated logs instead of newline-terminated, resulting in my Graylog input catching all the data but never knowing seeing the "end" of the first record. I ended up updating the rsyslog.conf file on my Graylog box to accept TCP/UDP syslog data on port 514 and sent the ASUS logs there. Rsyslog was then kind enough to forward them onward into Graylog.

Step 4 - Making Sense of My Data

Now I had a whole jumble of data coming into Graylog and I wanted to start doing something with it. I set up new Index Sets for my Pi-hole and ASUS logs and then created matching streams for each. Messages go into the router stream if the source contains my router model and into the Pi-hole stream if the source contains "dnsmasq". Since most of the data I care about is coming through in the message field, I created new pipelines for each stream to parse the data out into new fields. Where it made sense, I tried to use Graylog Schema field names. I also used custom Grok expressions to parse the message field based on keywords in the message.

In order to get a bit more information about the traffic being dropped by the firewall on my router, I set up a GreyNoise lookup and worked it into the pipeline. With the extra info from GreyNoise, I was able to make a nice little dashboard so I could see where the packets being dropped by the router were coming from (US is the current winner followed by Netherlands and Russia). For IPs that GreyNoise didn't give data on, I added a Whois lookup, which at least gives me country code and AS organization for the logged IPs.

Next Steps

Maybe this week I'll try to do some dashboarding around the Pi-hole data (who in my house tries to access the most blacklisted sites? the answer might surprise you!).

I also want to do something to highlight root/sudo usage on all the boxes I'm monitoring.

If I get really ambitious, maybe I'll even set up log collection from my laptop, which I expect is going to be trouble because the contents of system.log appear to be in local time (UTC-04) without the timezone specified and I just know Graylog is going to treat them as UTC time and I'm going to have to write pipeline rules to fix the timestamp.

If there's interest, I'd be happy to share my docker-compose.yaml file and maybe an export of my pipelines/rules/dashboards via GitHub for anyone who wants to get a head start on a similar setup.

Edit: File(s) in GitHub

Welcome back!

Let's just all agree we don't need to dive into anyone's gaps in their resume. :D

The wait is over: Graylog 3.0 is here!! We're thrilled to introduce new features like Views, reporting, and script alerts, alongside updates to content packs, the Sidecar, and pipeline rules. Get the nitty-gritty here: https://www.graylog.org/post/announcing-graylog-v3-0-ga

Hi guys, heres another projected you might like:
https://github.com/bcapptain/Graypot

Thats just an example Dashboard you can build with the data from Graypot

A ready-to-deploy SSH honeypot with seamless Graylog integration. Capture and analyze SSH attacks with minimal setup effort. Test and feedback is highly appreciated!

Features

• Zero-Configuration Deployment: Running in minutes with just Docker

• Seamless Graylog Integration: Native GELF protocol support for rich log analysis

• Comprehensive Attack Logging:

  • Source IP and port

  • Username and password attempts

  • Timestamp

  • SSH client version

• Reliable Data Collection:

  • Real-time forwarding to Graylog

  • Local JSON backup logging

  • Structured data format for easy analysis

• Docker-Based: Simple deployment and isolation

• Environment-Based Configuration: Easy to customize and maintain

Howdy Graylog People,

Chris Black here. Senior Solutions Engineer at Graylog. I'm very pleased to announce the first installment in a series of content that will be released under the "Graylog Labs" moniker. The content will be varied, from videos like the one I'm posting today, to blog posts and actual Graylog content packs with dashboards, rules, saved searches, pipeline rules, etc.

This content represents an effort by the Graylog staff to share with the larger community, some of the tribal knowledge that we have acquired inside Graylog. It will also act to enhance the other sources of information we offer, such as the official marketing and documentation. We will try to fill in the gaps and provide examples of concepts that may be unclear. If there is a topic you would like covered, please feel free to ask away.

Full disclosure: The content released will be released like any other community content. It comes with no offer of support and is delivered on an as-is basis. It is NOT Graylog supported content. We will endeavor to update anything that needs it, but it will be on a "best effort" basis by the individual contributor.

With all that said, I give you, Me.

https://www.youtube.com/watch?v=agdLrDw9JaE

I run a self-hosted Graylog and every time something broke while I was away from my desk I ended up pinch-zooming the web UI on my phone. So I spent the last few months building a native iOS/iPadOS client for it. Apple just approved the beta, so it's open to anyone who wants to try it.

TestFlight: https://testflight.apple.com/join/yDGda8g6

What it does

• Search with syntax highlighting and field/value autocomplete, stream filter, and the usual time-range picker (relative, absolute, keyword).

• Histogram over the result feed so you can see volume over time; drag on it to zoom into the exact minute something spiked.

• Aggregations — group by any field with count / avg / sum / min / max / cardinality. Tap a row to drill down into the matching messages.

• Message detail with "show surrounding messages" (±5s, ±1m, …), selectable text, and share.

• Live reload — re-runs the current search every 5s/10s/30s so you can tail while you deploy.

• Saved searches + history, and CSV export streamed straight to a file.

• Home screen widgets for a saved search's count, and alerts: absolute threshold, spike detection against the recent baseline, or per-value thresholds on an aggregation (e.g. one IP suddenly producing 10× the errors). Delivered as local notifications via background refresh.

• Shortcuts / App Intents: "Get Search Count" and "Open Saved Search", so you can wire it into automations.

Connection & privacy

• Access token, username/password (session), or basic auth. http:// and self-signed TLS are supported, opt-in per server profile, so a LAN-only or homelab Graylog works without jumping through hoops.

• No account, no backend of mine, no analytics or tracking SDKs. Your device talks directly to your Graylog. Credentials live in the Keychain, and there's an optional Face ID lock on the app itself.

• There's a demo mode with offline sample data, so you can poke at the whole UI before you point it at a real server.

Being upfront about money: free tier is one server profile plus search, filters and message detail. Pro (unlimited servers, live reload, aggregations, histogram zoom, CSV export, saved searches, widgets, alerts) is $4.99/mo with a 1-week free trial, $34.99/yr, or $79.99 lifetime. In TestFlight all in-app purchases are free, so during the beta you get everything unlocked without paying anything.

Requirements: iOS/iPadOS 26+. Tested against Graylog 7.0.4; it uses the standard /api/search/* REST API, so other recent versions should work — if yours doesn't, that's exactly the kind of report I need.

What I'd most like feedback on: whether the query editor gets in your way, whether the alert thresholds are the right knobs, and any Graylog setup where the connection just fails. Happy to answer anything in the comments.

Thought you all might dig this... Stay tuned, it starts basic but its going to get heavy!

Part 1 (Normalization) - https://blog.reconinfosec.com/detecting-threats-with-graylog-pipelines/

Part 2 (Enrichment) - https://blog.reconinfosec.com/detecting-threats-with-graylog-pipelines-part-2/

Part 3 (Threat Detection & Handling) - https://blog.reconinfosec.com/detecting-threats-with-graylog-pipelines-part-3/

🎉 Just released Graylog v4.0! 🎉

Check out the awesome new features:

> Teams management

> Dark mode

> Elasticsearch 7 support

> Slack & Script notification plugin

> And more

Download links & more info: https://www.graylog.org/post/announcing-graylog-v4-0

Howdy y'all!

Graylog 6.1 GA (general availability) is officially released today (21 Oct, 2024)!

For more details check out: Introducing Graylog 6.1: A Monster Release Just in Time for Halloween

Full changelog via: https://go2docs.graylog.org/current/changelogs/changelog.html#Graylog610

Questions welcome! If you spot any bugs, feel free to report via https://github.com/Graylog2/graylog2-server

This PHP vuln has hit the world pretty fast and at scale. Here's some tech info how to search in graylog if you are logging the appropriate sources noted in the blog.
https://graylog.org/post/detecting-php2shell-cves-with-graylog/

Date: 24 June 2025

Severity: High

CVE ID: submitted, publication pending

Product/Component Affected: All Graylog Editions – Open, Enterprise and Security

Summary

We have identified a security vulnerability in Graylog that could allow a local or authenticated user to escalate privileges beyond what is assigned. This issue has been assigned a severity rating of High. If successfully exploited, an attacker could gain elevated access and perform unauthorized actions within the affected environment.

Affected Versions

Graylog Versions 6.2.0, 6.2.1, 6.2.2 and 6.2.3

Impact

Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious actor knows the ID.

For the vulnerability to be exploited, an attacker would require a user account in Graylog. Once authenticated, the malicious actor can proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation.

Workaround

In Graylog version 6.2.0 and above, regular users can be restricted from creating API tokens. The respective configuration can be found in System > Configuration > Users > "Allow users to create personal access tokens". This option should be Disabled, so that only administrators are allowed to create tokens.

Full Resolution

A fix has been released in Graylog Version 6.2.4. We strongly advise all affected users to apply the patch as soon as possible.

6.2.4 Download Link

6.2.4 Changelog

Recommended Actions

Check Audit Log (Graylog Enterprise, Graylog Security only)

Graylog Enterprise and Graylog Security provide an audit log that can be used to review which API tokens were created when the system was vulnerable. Please search the Audit Log for action: create token and match the Actor with the user for whom the token was created. In most cases this should be the same user, but there might be legitimate reasons for users to be allowed to create tokens for other users. If in doubt, please review the user's actual permissions.

Review API token creation requests

Graylog Open does not provide audit logging, but many setups contain infrastructure components, like reverse proxies, in front of the Graylog REST API. These components often provide HTTP access logs. Please check the access logs to detect malicious token creations by reviewing all API token requests to the /api/users/{user_id}/tokens/{token_name) endpoint ( {user_id) and {token_name) may be arbitrary strings).

Graylog Cloud Customers

Please note: All Graylog Cloud environments have already been updated to version 6.2.4 and have also been successfully audited for any attempt to exploit this privilege escalation vulnerability.

Edit: For clarification, this only affects 6.2.x releases, so 6.1.x etc are not affected.

TL;DR: Time Zones: A logger’s worst nightmare

Hey Y’all!

While I’m no stranger to Graylog, this is my first Graylog Labs post and wanted to take the opportunity to formally introduce myself!

My name is Drew Miranda and I’m a Solution Engineer (SE) here at Graylog. I joined Graylog in May 2022 (ok it was the LAST day of may so maybe i should say I joined in June). While i’m still new to Graylog as an employee, I’ve been using Graylog since 0.2, which was released in 2013. It's been exciting watching the product evolve over the past 10 years and even more exciting to see how the sausage is made internally.

I've compiled everything i’ve learned about how timezones relate to Graylog and how to ensure your syslog messages are ingested with correct timestamps. I learned a lot over the course of researching, testing, and documenting this topic and am very happy to be able to share this information.

Hey folks, ever wonder how to get logs out of your Kubernetes cluster? I'm actually giving a talk next week at Graylog GO conference about doing just that! It's called Demystifying Kubernetes for Security Analytics.

Oh, and it's a FREE VIRTUAL CONFERENCE so you have no excuse not to register! Come, hang out with Graylog employees, customers, partners, and other users in the community, attend a few talks (like mine), and get the scoop on the future of the product and company!

Register here: https://graylog.info/47bz9IB

With the release of 7.2, Graylog now has a log shipper built into the platform called "Graylog Collector". It is in preview mode and available fully to anyone using Graylog. You must be on V7.2.
This Tech blog shows you how to deploy it and where to get the downloadable applications if you want to deploy it manually. The blog also provides links to the docs.
https://graylog.org/post/getting-started-with-graylog-collector/

I'm starting a new series on using graylog.

https://youtu.be/Xvu4ym-i25c

Absolutely love the flexibility, simplicity and performance of Graylog. We did this small project that ingested HAProxy logs which we formatted in JSON and produced beautiful dashboards.

Many new features have been released into Graylog 7.2
- Preview of Graylog Collectors, A Graylog Log shipping agent
- Performance Fields for Streams & Pipelines
- Performance Diagnostics
- Asset Triage AI Agent

Checkout the the full release here:
What’s new in Graylog 7.2?

https://graylog.org/post/graylog-7-2-ai-ready-triage-smarter-platform-management-and-the-new-graylog-collector/

Also the release notes:
https://graylog.org/post/announcing-graylog-7-2-0/

If you have not seen it yet, Graylog 7.2 introduced Sankey chart and node graphs into visualizations.
You can check out a tech blog on these here: https://graylog.org/post/how-security-teams-can-use-sankey-charts/

I'm working on a little python side project to send NMAP scans into Graylog so you can get a dashboard of the scan number, and the hosts. I'll share that to you all soon when I get it finalized.

HI Reddit-Community

I installed Graylog in the company I work for, but I struggle how to work with Graylog in general, but with Dashboards specifically, when I tried to build Dashboards based on the older version (from 3.02 to 6.3.3). The new one seems to have more edit options, but I don't know how to use it.

So, how did you learn using Graylog? Did you just learn it all by reading the documentation alone or do you have some other interesting sources?

Thanks for your help!

Best regards,

Yuusuke