Graylog

Give an agent access to Graylog with an API token.

Required permissions

Tool	Required Permission	Description
list_streams	streams:read	Get a list of all Graylog streams. Useful for finding the IDs of streams to limit the search using search_logs.
search_logs	streams:read, search:execute, message:read	Search Graylog logs/messages. Use query and one of two time range types to filter data relevant to the current alert. Specify either both absolute time ranges or the keyword alternative. Absolute time ranges take precedence.

Create API token

Using the Graylog MCP server requires an API token with appropriate permissions.

1

Create token via Graylog web interface

• Log in to your Graylog web interface
• Navigate to System → Users (or Administration → Users depending on your Graylog version)
• Select the user you want to create a token for, or create a new user specifically for the MCP agent:

  • Click Create user (if creating a new user)
  • Enter username, email, and password
  • Assign appropriate role (see next step)

2

Assign permissions to the user

• Go to System → Roles (or Administration → Roles)
• Create a new role or edit an existing one (e.g., "ilert-readonly")
• Grant the following permissions:

  • streams:read - Read access to streams
  • streams:read:YOUR_STREAM_ID - Read access to specific streams (optional, for restricted access)
  • search:execute - Execute search queries
  • message:read - Read log messages
• Assign this role to your user

3

Generate an API token

• Navigate to System → Users → Select your user
• Go to the Tokens tab (or API Tokens section)
• Click Create API token (or Generate token)
• Enter a name for the token (e.g., "ilert-mcp-agent")
• Set expiration (optional, recommended for security)
• Click Create or Generate
• Copy the API token immediately (it won't be shown again)
• Store the token securely. You will need this token when setting up the Graylog MCP server in ilert.

Create API token via REST API

Alternatively, you can create an API token using the Graylog REST API.

1

Authenticate and get a session token

curl -X POST "https://your-graylog-instance:9000/api/system/sessions" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": "your-password",
    "host": "your-hostname"
  }'

Extract the session token from the response.

2

Create an API token

curl -X POST "https://your-graylog-instance:9000/api/users/YOUR_USERNAME/tokens" \
  -H "Content-Type: application/json" \
  -H "X-Requested-By: ilert" \
  -H "Authorization: Basic YOUR_SESSION_TOKEN" \
  -d '{
    "name": "ilert-mcp-agent",
    "expiration": "365d"
  }'

Replace YOUR_USERNAME with your Graylog username and YOUR_SESSION_TOKEN with the session token from the previous step.

Verify API token access

Before configuring the MCP server, verify that your API token works:

# Test API token authentication
curl -H "Authorization: Bearer YOUR_API_TOKEN" \
  https://your-graylog-instance:9000/api/system/overview

# Test search access
curl -X POST "https://your-graylog-instance:9000/api/search/universal/relative" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "*",
    "range": 3600
  }'

Replace YOUR_API_TOKEN with your actual API token and your-graylog-instance with your Graylog server URL.

Note: The API token format and endpoints may vary slightly depending on your Graylog version. Refer to the Graylog API documentation for version-specific details.

Connect Graylog with agent

To connect Graylog with your AI SRE agent:

1

Navigate to Agents in the ilert navigation menu

2

Open the agent detail view for the agent you want to configure

3

Go to the Tools tab

4

Under the ilert hosted MCP servers section, locate the Graylog card

5

Click Connect on the Graylog card

6

In the connection dialog that appears:

• Select connector: Choose "Create new connector" (or select an existing connector if you have one)
• Type: Select Bearer Token from the dropdown
• Secret name: Enter a name for your connector (e.g., "Graylog Production" or "Graylog Main")
• Secret value: Paste the API token you created earlier
• Host URL: Enter your Graylog instance URL (e.g., https://graylog.example.com:9000)

7

Click Connect to complete the connection

8

After connecting, you can enable or disable specific tools needed for alert investigation, such as:

• list_streams - Get a list of all Graylog streams
• search_logs - Search Graylog logs/messages with flexible query options

The Graylog integration is now connected and ready to use for root cause analysis.