Getting Started with Graylog

Graylog is an open-source log management solution that enables you to collect, index, and analyze log data. It is built on top of Elasticsearch and provides a powerful web interface for searching and visualizing logs, making it an essential tool for operational monitoring and troubleshooting. This tutorial will guide you through the installation and initial setup of Graylog.

Prerequisites

• A server running Linux (Ubuntu is commonly used).
• Java Development Kit (JDK) installed on your server.
• Elasticsearch installed and running.
• MongoDB installed on your server.

1. Installing Dependencies

If you haven’t installed MongoDB and Elasticsearch, you can do so using the following commands:

• For MongoDB:

  sudo apt update
  sudo apt install -y mongodb

• For Elasticsearch:

  wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
  sudo sh -c 'echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" > /etc/apt/sources.list.d/elastic-7.x.list'
  
  sudo apt update
  sudo apt install elasticsearch -y

Ensure that both services are running:

sudo systemctl start elasticsearch
sudo systemctl start mongodb

2. Downloading and Installing Graylog

Download the latest Graylog server package from the official website:

wget https://downloads.graylog.org/release/graylog-4.0.0.tgz

Extract the downloaded archive:

tar -xzf graylog-4.0.0.tgz

Move into the Graylog directory:

cd graylog-4.0.0

3. Configuring Graylog

Graylog requires certain environment variables to be set. Create a configuration file:

nano graylog.conf

Add the following basic configurations:

GRAYLOG_HTTP_HOSTNAME=127.0.0.1
GRAYLOG_HTTP_PORT=9000
GRAYLOG_ELASTICSEARCH_HOSTS=http://127.0.0.1:9200
GRAYLOG_MONGODB_URI=mongodb://127.0.0.1:27017/graylog

4. Starting Graylog Server

Before starting the Graylog server, make sure that Elasticsearch and MongoDB are up and running. Then start the Graylog server with:

bin/graylog-server

Alternatively, you can run Graylog as a service by using a process manager like systemd.

5. Accessing Graylog Web Interface

After starting Graylog, open a web browser and go to:

http://127.0.0.1:9000

Log in using the default credentials:

• Username: admin
• Password: admin

6. Adding Inputs to Graylog

To start receiving logs, you need to configure inputs:

1. In the Graylog web interface, navigate to System > Inputs.
2. Select an input type (e.g., Syslog UDP, GELF TCP) and click Launch new input.
3. Fill in the required settings and start the input.

7. Exploring Graylog Features

Graylog provides powerful features for log management, including search capabilities, stream processing, and alerts. Explore the interface to familiarize yourself with these functionalities.

8. Conclusion

By following this tutorial, you have set up Graylog for log management effectively. With its robust features, Graylog allows you to analyze logs to gain insights and monitor your applications efficiently. Continue exploring Graylog’s documentation to utilize advanced features and improve your logging strategies!

About the Author

Dorian Kane

Author

View All Posts