🔍 Graylog MCP Server

An MCP server that gives AI assistants direct access to your Graylog logs -- search, aggregate, analyze, and cluster log data through natural language.

What It Does

This server exposes your Graylog instance(s) as MCP tools, so AI assistants like Claude, Cursor, and others can query logs on your behalf. Instead of context-switching to the Graylog UI, you describe what you're looking for and the assistant handles the rest.

25 tools covering:

Log search -- full-text and field-filtered queries with pagination, exact/fuzzy matching, and configurable field selection
Contextual analysis -- fetch surrounding messages around a specific log entry
Aggregations -- histograms, field statistics, and two-dimensional field-over-time breakdowns
Log clustering -- group similar messages into structural templates using Drain3, with persistent template libraries per connection
Events -- search Graylog events, list event definitions and notifications
Saved searches -- save, list, and reuse query configurations
Multi-connection -- switch between Graylog instances (e.g., nonprod vs prod) within one session
Stream & field discovery -- list streams, discover distinct field values

Prerequisites

Node.js 18+
Graylog 6.x (tested on 6.2)
A Graylog API token (how to create one)

Installation

Via npx (recommended)

No installation needed. Configure your MCP client to run:

{
  "mcpServers": {
    "graylog": {
      "command": "npx",
      "args": ["graylog-mcp-server"]
    }
  }
}

From source

git clone https://github.com/jagadeesh52423/graylog-mcp.git
cd graylog-mcp
npm install

Then point your MCP client to the local entry point:

{
  "mcpServers": {
    "graylog": {
      "command": "node",
      "args": ["/absolute/path/to/graylog-mcp/src/index.js"]
    }
  }
}

Configuration

Create ~/.graylog-mcp/config.json:

{
  "connections": {
    "nonprod": {
      "baseUrl": "http://graylog-nonprod:9000",
      "apiToken": "your_api_token"
    },
    "prod": {
      "baseUrl": "http://graylog-prod:9000",
      "apiToken": "your_prod_api_token",
      "defaultFields": ["timestamp", "message", "level", "source", "PODNAME"]
    }
  },
  "defaultFields": ["timestamp", "gl2_message_id", "source", "env", "level", "message", "logger_name"]
}

| Option | Scope | Description | |---|---|---| | connections | Root | Named Graylog instances, each with baseUrl and apiToken | | defaultFields | Root | Global default fields returned in search results | | defaultFields | Connection | Per-connection override (takes priority over global) |

If no defaultFields are set, all fields (*) are returned.

Override the config path with the GRAYLOG_CONFIG_PATH environment variable:

{
  "mcpServers": {
    "graylog": {
      "command": "npx",
      "args": ["graylog-mcp-server"],
      "env": {
        "GRAYLOG_CONFIG_PATH": "/path/to/custom/config.json"
      }
    }
  }
}

MCP Client Config Locations

| Client | Config file | |---|---| | Claude Code | ~/.claude/mcp.json | | Cursor | ~/.cursor/mcp.json | | Claude Desktop (macOS) | ~/Library/Application Support/Claude/claude_desktop_config.json |

Usage

Once connected, talk to your AI assistant naturally. Some examples:

Connect to nonprod and show me error logs from the last hour

What are the top error sources in production over the past 6 hours?

Show me a histogram of level 3 errors over the past day, broken down by hour

Cluster the last 1000 error messages and show me the top patterns

Show me the messages surrounding log ID 01KH5PDR893AZJQBYJJ87AQTW5

Time Ranges

Relative: 30m, 1h, 2d, 1w, 3M, 1y

Absolute: provide from/to as ISO timestamps (2024-01-15T09:00:00Z) or Unix millis.

Default is 15 minutes if unspecified.

Available Tools

Connection Management

| Tool | Description | |---|---| | list_connections | List configured Graylog connections | | use_connection | Switch to a named connection |

Log Search

| Tool | Description | |---|---| | fetch_graylog_messages | Search logs with query, filters, time range, pagination | | get_surrounding_messages | Get messages around a specific log entry by ID or timestamp | | list_streams | List available Graylog streams | | list_field_values | Discover distinct values for a field (top N by count) |

Aggregations

| Tool | Description | |---|---| | get_log_histogram | Time-bucketed message counts | | get_field_aggregation | Group by field with metrics (count, sum, avg, min, max) | | get_field_time_aggregation | Two-dimensional: field values over time intervals | | debug_histogram_query | Debug helper for empty histogram results |

Log Clustering

| Tool | Description | |---|---| | cluster_log_messages | Group similar messages into structural templates (Drain3) | | list_log_templates | List learned templates for the active connection | | delete_log_template | Remove a template | | rename_log_template | Give a template a human-readable label | | export_log_templates | Export template library as JSON | | import_log_templates | Bulk import templates (merge or replace) |

Templates are persisted at ~/.graylog-mcp/templates/<connection>.json and improve over time as more messages are clustered.

Events

| Tool | Description | |---|---| | search_events | Search Graylog events with filters | | get_event_definitions | List event definitions | | get_event_notifications | List event notifications |

Saved Searches

| Tool | Description | |---|---| | save_search | Save a query configuration for reuse | | list_saved_searches | List all saved searches | | get_saved_search | Retrieve a saved search by name | | delete_saved_search | Delete a saved search |

Project Structure

src/
├── index.js                          Server bootstrap and request routing
├── config.js                         Connection config and field defaults
├── query.js                          Query building and Graylog API client
├── tools.js                          Tool schema definitions (25 tools)
├── timerange.js                      Flexible time range parsing
├── aggregations.js                   Histogram, field stats, time-series
├── events.js                         Graylog events API
├── saved-searches.js                 Persistent saved search store
├── clustering/
│   ├── index.js                      Strategy registry
│   ├── preprocess.js                 Message normalization and tokenization
│   ├── formatter.js                  Cluster response formatting
│   ├── template-store.js             Per-connection template persistence
│   └── strategies/
│       └── drain3.js                 Drain3 log clustering algorithm
└── tools/
    ├── cluster-errors.js             cluster_log_messages handler
    └── template-mgmt.js              Template CRUD handlers

Adding a Clustering Algorithm

Create src/clustering/strategies/<name>.js implementing hydrate, serialize, and cluster (see drain3.js)
Register it in src/clustering/index.js
Pass algorithm: "<name>" to cluster_log_messages

License

MIT

Graylog MCP Server