Skip to main content
Connect your Graylog cluster to let Alex (Cloud Infrastructure) and Kai (Kubernetes) check cluster health, list your streams and index sets, search recent messages over a limited time window, and count messages grouped by a field. Graylog authenticates with a REST API access token belonging to a Graylog user. The connection is read-only: the Graylog API can change things, but CloudThinker gives agents no way to reach those endpoints, so they can read your logs and never change anything in Graylog.

​
Prerequisites

  • A Graylog cluster reachable from CloudThinker over HTTPS.
  • A least-privilege Graylog user for CloudThinker with the Reader role.
  • Read access shared on the streams and index sets you want agents to read. The Reader role alone is not enough — see Required permissions.
  • A REST API access token for that user.
Create a dedicated Graylog user for CloudThinker rather than reusing a person’s account. The token inherits that user’s access, so a dedicated reader keeps the scope visible and revocable in one place.

​
Setup

1

Create a read-only Graylog user

In Graylog, go to System → Users and Teams and create a user for CloudThinker with the Reader role. Every Graylog user holds either Reader or Admin, and Reader is the read-only baseline.
2

Share the streams and index sets with that user

The Reader role by itself grants no access to your entities — Graylog controls those by sharing. Share each stream and index set CloudThinker should read with the new user at the Viewer access level.Skip this and Graylog returns an empty list of streams instead of an error, which looks like a Graylog with no streams rather than a missing permission.
3

Create a REST API access token

Still in System → Users and Teams, find the user, open the More drop-down, and select Edit tokens. Enter a token name, set the TTL using ISO 8601 duration format, and click Create Token.Copy the token immediately — Graylog does not show it again.
4

Add the connection in CloudThinker

Navigate to Connections → Graylog and enter:
  • Graylog base URL: your Graylog web/API root, such as https://graylog.example.com:9000
  • API token: the token you just created
  • TLS certificate: leave on Verify TLS certificate
Click Connect. CloudThinker reads your cluster status to verify the token and shows a Connected status with the node count it found.
Graylog access tokens expire. The default TTL is 30 days, after which the connection starts failing with a rejected-token error. Set a TTL that matches your rotation schedule, and update the connection with a new token before the old one expires. An administrator can change the default under System → Configurations → Users.
Enter the Graylog web/API root only. Do not append /api, a path, a query string, or credentials — CloudThinker adds /api itself, and rejects a URL that carries anything else.

​
Connection details

GRAYLOG_URL must use https. The token is sent with every request, so plain http is accepted only when Graylog runs on the same machine as CloudThinker.

​
Required permissions

The token needs read access, and Graylog splits that across two layers:
The Reader role on its own is the most common misconfiguration. Graylog returns an empty list of streams and a success code rather than a 403, so the connection tests as Connected while agents report that no streams exist. If discovery shows no streams on a cluster that has them, share the streams and index sets with the token’s user.
No Graylog permission beyond read is ever needed. CloudThinker exposes no Graylog write action, so nothing here is approval-gated — granting write access only widens what a leaked token could do.

​
Agent capabilities

Once connected, agents have read access to your Graylog cluster.

​
Verify the connection

​
Example prompts

Searches and counts are bounded so a broad question cannot pull your whole cluster: the time window reaches back at most 30 days, and results return at most 100 rows or groups. Agents tell you which time window and limit they used, and say when a result was cut short instead of presenting it as a total. Narrow the query or the time window when you need an exact count.

​
Troubleshooting

The token expired, was revoked, or was copied incompletely. Graylog tokens expire at their TTL, which defaults to 30 days. Create a new token under System → Users and Teams → More → Edit tokens and update the connection.
The token is valid but its Graylog user lacks the read role. Give the user the Reader role, then test the connection again.
The user has the Reader role but no streams shared with it, so Graylog returns an empty page instead of denying the request. Share each stream and index set with that user at Viewer access. An empty list here means the token cannot see those streams, not that Graylog has none.
The base URL points at the wrong root or already contains /api. Reconnect with the web/API root only, such as https://graylog.example.com:9000.
The base URL is plain http for a host that is not on the CloudThinker machine, which would send the token in clear text. Serve Graylog over HTTPS and reconnect.
Skip TLS verification is rejected for a remote Graylog. Without verification, the token is sent to whichever server answers, so the connection could report success while talking to the wrong one. Install the issuer of your Graylog certificate as trusted and keep Verify TLS certificate on.
Nothing answered at the base URL. Check the host, the port, and that your firewall or network policy allows CloudThinker to reach the Graylog API.
Graylog, or a proxy or load balancer in front of it, returned HTTP 429. Wait, then run one scoped request again rather than several broad ones.
The query hit the result limit, or the search timed out before it finished. A search that times out does not tell you how many messages matched — narrow the query, shorten the time window, or group by a more specific field, then ask again.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Keep certificate verification on — the token is sent with every request, so turning verification off exposes it to whichever server answers.
  • Watch the token TTL — a token that expires silently breaks the connection; rotate it on schedule and update the connection with the new value.
  • Share only the streams you want read — entity sharing, not the role, is what decides which logs agents can see.

Coralogix Connection

Log search, metrics, traces, and incident triage

Elasticsearch Connection

Log analysis, index management, and search performance optimization