Graylog icon

Graylog

Consume Graylog API (v.1.1.0)

Actions20

Overview

This n8n node interacts with the Graylog API to export a defined set of messages. It is designed for scenarios where users need to extract specific log data from Graylog, such as for compliance, troubleshooting, or analytics purposes. The node allows you to specify query parameters and additional options to tailor the export, and supports both token-based and basic authentication.

Practical examples:

  • Exporting logs matching a particular search query for further analysis.
  • Automating the extraction of error messages within a certain time range.
  • Downloading a batch of messages for archiving or reporting.

Properties

Name Type Meaning
Authentication options The authentication method to use (Token Authentication or Basic Authentication).
Query String string The search query used to filter which messages are exported.
Additional Fields collection Optional settings to refine the export, such as chunk size, time range, time zone, and limit.
Simplify boolean If enabled, simplifies the output structure for easier downstream processing.
Simplify Path string Specifies a path to a property that should be returned if simplification is enabled.

Additional Fields (collection options):

  • Chuck Size (number): Size of each chunk in the export.
  • Timerange Type (string): Type of time range to apply to the export.
  • Time Zone (string): Time zone context for the export.
  • Limit (number): Maximum number of messages to export.

Output

The node outputs a json field containing the exported messages from Graylog. The structure of this output depends on the "Simplify" option:

  • If "Simplify" is false:
    The output will include the full response from the Graylog API, typically an array of message objects with all their properties.

  • If "Simplify" is true:
    The output will be reduced to only the specified property (if "Simplify Path" is provided), or a simplified version of the message objects.

Example output (simplified):

[
  {
    "message": "Error: Something failed",
    "timestamp": "2024-06-01T12:00:00Z",
    "source": "app-server"
  },
  ...
]

If binary data is returned (not typical for this operation), it would represent exported log files or archives.

Dependencies

  • Graylog instance: You must have access to a running Graylog server.
  • API Credentials: Either a valid API token or username/password for Graylog, configured in n8n credentials as graylogTokenApi or graylogBasicApi.
  • n8n configuration: Ensure the node has network access to the Graylog API endpoint.

Troubleshooting

Common issues:

  • Authentication errors:

    • Error message: "Invalid credentials" or "401 Unauthorized"
      Resolution: Check that the correct authentication method is selected and credentials are valid.

  • Query errors:

    • Error message: "Invalid query string" or "400 Bad Request"
      Resolution: Verify the syntax of your query string matches Graylog's search query format.

  • Export limits:

    • Error message: "Result set too large"
      Resolution: Use the "Limit" field in Additional Fields to restrict the number of messages exported.

  • Connection errors:

    • Error message: "Unable to connect to Graylog API"
      Resolution: Ensure the Graylog server is reachable from your n8n instance and the API URL is correct.

Links and References

Discussion