Graylog

Overview

The Graylog node's "Validation" resource with the "Validate Search Query" operation is designed to validate search queries written in Lucene syntax against a Graylog instance. This is useful for users who want to ensure their search queries are syntactically correct and compatible with Graylog before executing them, reducing errors in log management workflows.

Common scenarios:

• Validating user-inputted search queries in automated log analysis pipelines.
• Pre-checking complex queries before running them on large datasets to avoid runtime errors.
• Integrating query validation into approval or review processes for security and compliance.

Practical example:
A DevOps engineer can use this node to automatically check if a new log search filter (in Lucene syntax) is valid before deploying it to production monitoring dashboards.

Properties

Output

• The node outputs a json field containing the result of the query validation from Graylog.
• If "Simplify" is enabled, the output may be reduced to a specific property or structure, optionally filtered by "Simplify Path".
• The exact structure depends on the Graylog API's response for query validation, but typically includes:
  • Validation status (e.g., valid/invalid)
  • Error messages or details if the query is invalid
  • Possibly additional metadata about the query

Note:
This node does not output binary data.

Dependencies

• External Service: Requires access to a Graylog server with the appropriate API endpoints enabled.
• Authentication: Needs either a Graylog API token or username/password credentials, depending on the selected authentication method.
• n8n Credentials: Must configure either "graylogTokenApi" or "graylogBasicApi" credentials in n8n.

Troubleshooting

Common issues:

• Invalid Credentials:
  Error message: "Authentication failed" or similar.
  Resolution: Ensure the correct credentials are set up in n8n and have sufficient permissions.

• Malformed Query:
  Error message: "Query is not valid Lucene syntax" or detailed error from Graylog.
  Resolution: Double-check the query syntax; refer to Lucene Query Syntax documentation.

• Connection Errors:
  Error message: "Cannot connect to Graylog server" or timeout errors.
  Resolution: Verify network connectivity and Graylog server URL.

• Missing Required Fields:
  Error message: "Query is required" or similar.
  Resolution: Ensure all required fields, especially "Query", are filled in.

Links and References

• Graylog Documentation
• Lucene Query Syntax
• n8n Credentials Documentation