> For the complete documentation index, see [llms.txt](https://docs.ilert.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ilert.com/ai-and-agents/mcp/hosted/graylog.md).

# Graylog

Give an agent access to Graylog with an API token.

#### Required permissions

<table><thead><tr><th width="135.80859375">Tool</th><th>Required Permission</th><th>Description</th></tr></thead><tbody><tr><td><code>list_streams</code></td><td><code>streams:read</code></td><td>Get a list of all Graylog streams. Useful for finding the IDs of streams to limit the search using <code>search_logs</code>.</td></tr><tr><td><code>search_logs</code></td><td><code>streams:read</code>, <code>search:execute</code>, <code>message:read</code></td><td>Search Graylog logs/messages. Use <code>query</code> and one of two time range types to filter data relevant to the current alert. Specify either both absolute time ranges or the keyword alternative. Absolute time ranges take precedence.</td></tr></tbody></table>

#### Create API token

Using the Graylog MCP server requires an API token with appropriate permissions.

{% stepper %}
{% step %}
**Create token via Graylog web interface**

* Log in to your Graylog web interface
* Navigate to **System** → **Users** (or **Administration** → **Users** depending on your Graylog version)
* Select the user you want to create a token for, or create a new user specifically for the MCP agent:
  * Click **Create user** (if creating a new user)
  * Enter username, email, and password
  * Assign appropriate role (see next step)
    {% endstep %}

{% step %}
**Assign permissions to the user**

* Go to **System** → **Roles** (or **Administration** → **Roles**)
* Create a new role or edit an existing one (e.g., "ilert-readonly")
* Grant the following permissions:
  * `streams:read` - Read access to streams
  * `streams:read:YOUR_STREAM_ID` - Read access to specific streams (optional, for restricted access)
  * `search:execute` - Execute search queries
  * `message:read` - Read log messages
* Assign this role to your user
  {% endstep %}

{% step %}
**Generate an API token**

* Navigate to **System** → **Users** → Select your user
* Go to the **Tokens** tab (or **API Tokens** section)
* Click **Create API token** (or **Generate token**)
* Enter a name for the token (e.g., "ilert-mcp-agent")
* Set expiration (optional, recommended for security)
* Click **Create** or **Generate**
* Copy the API token immediately (it won't be shown again)
* Store the token securely. You will need this token when setting up the Graylog MCP server in ilert.
  {% endstep %}
  {% endstepper %}

#### Create API token via REST API

Alternatively, you can create an API token using the Graylog REST API.

{% stepper %}
{% step %}
Authenticate and get a session token

```bash
curl -X POST "https://your-graylog-instance:9000/api/system/sessions" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": "your-password",
    "host": "your-hostname"
  }'
```

Extract the session token from the response.
{% endstep %}

{% step %}
Create an API token

```bash
curl -X POST "https://your-graylog-instance:9000/api/users/YOUR_USERNAME/tokens" \
  -H "Content-Type: application/json" \
  -H "X-Requested-By: ilert" \
  -H "Authorization: Basic YOUR_SESSION_TOKEN" \
  -d '{
    "name": "ilert-mcp-agent",
    "expiration": "365d"
  }'
```

Replace `YOUR_USERNAME` with your Graylog username and `YOUR_SESSION_TOKEN` with the session token from the previous step.
{% endstep %}
{% endstepper %}

#### Verify API token access

Before configuring the MCP server, verify that your API token works:

```bash
# Test API token authentication
curl -H "Authorization: Bearer YOUR_API_TOKEN" \
  https://your-graylog-instance:9000/api/system/overview

# Test search access
curl -X POST "https://your-graylog-instance:9000/api/search/universal/relative" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "*",
    "range": 3600
  }'
```

Replace `YOUR_API_TOKEN` with your actual API token and `your-graylog-instance` with your Graylog server URL.

{% hint style="info" %}
**Note:** The API token format and endpoints may vary slightly depending on your Graylog version. Refer to the [Graylog API documentation](https://docs.graylog.org/docs/http-api) for version-specific details.
{% endhint %}

#### Connect Graylog with agent

To connect Graylog with your AI SRE agent:

{% stepper %}
{% step %}
Navigate to **Agents** in the ilert navigation menu
{% endstep %}

{% step %}
Open the agent detail view for the agent you want to configure
{% endstep %}

{% step %}
Go to the **Tools** tab
{% endstep %}

{% step %}
Under the **ilert hosted MCP servers** section, locate the **Graylog** card
{% endstep %}

{% step %}
Click **Connect** on the Graylog card
{% endstep %}

{% step %}
In the connection dialog that appears:

* **Select connector:** Choose "Create new connector" (or select an existing connector if you have one)
* **Type:** Select **Bearer Token** from the dropdown
* **Secret name**: Enter a name for your connector (e.g., "Graylog Production" or "Graylog Main")
* **Secret value**: Paste the API token you created earlier
* **Host URL:** Enter your Graylog instance URL (e.g., `https://graylog.example.com:9000`)
  {% endstep %}

{% step %}
Click **Connect** to complete the connection
{% endstep %}

{% step %}
After connecting, you can enable or disable specific tools needed for alert investigation, such as:

* `list_streams` - Get a list of all Graylog streams
* `search_logs` - Search Graylog logs/messages with flexible query options
  {% endstep %}
  {% endstepper %}

The Graylog integration is now connected and ready to use for root cause analysis.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ilert.com/ai-and-agents/mcp/hosted/graylog.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.