How logs reach Graylog from hosts, network devices, applications and cloud services, using the inputs and collectors Graylog documents. Graylog Open is licensed under SSPL-1.0, which is not an OSI-approved open source license, and some inputs need an Enterprise license.
Centrally managing log collectors on Linux and Windows hosts with Graylog Sidecar: API tokens per environment, installing Sidecar and Filebeat, Winlogbeat or Auditbeat, collector configurations pushed from Graylog, Beats inputs and the network paths each host needs.
Receiving logs from OpenTelemetry-instrumented services in Graylog over OTLP gRPC: configuring the OpenTelemetry Collector exporter, TLS and bearer token authentication, field mapping into Graylog's schema, and routing OTel logs into streams.
Collecting syslog from routers, firewalls and servers in Graylog: TCP versus UDP listeners, RFC 5424 and 3164 parsing, relaying non-compliant devices through rsyslog or syslog-ng, and buffering syslog through Kafka or AMQP pull inputs.
Bringing AWS logs into a self-hosted Graylog with the AWS Kinesis/CloudWatch input: streaming CloudWatch Logs and VPC flow logs through Kinesis, IAM setup, and when the S3, CloudTrail or Security Lake inputs fit better.
Pulling SaaS identity and productivity audit trails into Graylog with the Enterprise-licensed Office 365 and Okta inputs: Azure application registration and audit log prerequisites, Okta API keys, polling intervals, and version issues to check before upgrading.
Pulling CrowdStrike Falcon alerts and event streams into Graylog through the CrowdStrike API: the Enterprise license it needs, API client permissions, the matching content pack and correlating EDR alerts with other logs.
Collecting Azure Active Directory sign-in and audit logs, Azure activity, Network Watcher, AKS and Azure SQL logs in Graylog through Event Hubs: Enterprise licensing, the Listen policy, consumer groups and throughput planning.
Ingesting Microsoft Defender for Endpoint alerts and data into Graylog: the Entra app registration and API permissions, the Enterprise license, polling interval and network access to Microsoft endpoints.
Bringing Google Workspace audit logs into Graylog through the BigQuery export: the Google Cloud project and service account it needs, Enterprise licensing, the Illuminate content pack and BigQuery cost.
Collecting AWS CloudTrail logs in Graylog: the trail to S3, SQS notifications, IAM role permissions, multi-account trails and the setup wizard added in Graylog 7.1.
Sending PAN-OS traffic, threat and GlobalProtect logs to Graylog: the dedicated Palo Alto TCP and UDP inputs, syslog format on the firewall, Illuminate parsing and what the content pack change for PAN-OS 11 means.
Receiving Common Event Format logs from firewalls, proxies and security tools in Graylog: CEF over TCP, UDP, AMQP or Kafka, field naming options, TLS on TCP and when a vendor-specific input or content pack is better.
Collecting IPFIX flow records from routers and firewalls in Graylog: template handling, why load-balancing flows across inputs breaks parsing, storage growth from flow volume and dashboards for traffic analysis.
Collecting and parsing Windows security events such as logons, process creation and account changes in Graylog: Winlogbeat or NXLog through Sidecar, Beats prefix settings and the Illuminate Windows Security content pack.
Shipping logs from branch offices, plants or other networks to a central Graylog with the Forwarder: local inputs at the site, TLS to the cluster, edition requirements, and how Windows hosts feed it through Sidecar.
Ingesting data from SaaS tools and internal APIs that have no dedicated Graylog input: the JSON path from HTTP API input, polling intervals, authentication headers, rate limits and when a script or collector is more reliable.
Shipping Kubernetes container and node logs to Graylog with Fluent Bit and GELF: DaemonSet deployment, Kubernetes metadata enrichment, multiline logs, back pressure and routing namespaces to streams.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.