Graylog

About

Graylog log management system Read more

Relevant links

•   Homepage
•   Submit a bug

Discuss this charm

Share your thoughts on this charm with the community on discourse.

Join the discussion

Overview

The charm installs Graylog using the snap package.

Usage

juju deploy cs:~graylog-charmers/graylog
juju run-action --wait graylog/X show-admin-password

Graylog requires MongoDB to run and Elasticsearch to be useful.

juju deploy cs:~mongodb-charmers/mongodb
juju relate graylog:mongodb mongodb:database

juju deploy cs:~elasticsearch-charmers/elasticsearch
juju relate graylog:elasticsearch elasticsearch:client

You can then browse to http://ip-address:9000 and log in as the user "admin". The password is by default a random value so juju run-action --wait graylog/X show-admin-password must be run for admin access to the installation.

Reverseproxy Relation

Graylog supports advertising its ports to an application acting as a reverseproxy using the http relation. The port of the webUI is exposed over the relation in the all_services variable of the relation.

Note: For Graylog version 2, the API port is also exposed over the http relation. Graylog version 3 hard codes the /api/ location and uses the default port (9000) for both webUI and API.

More details on using this are in the reverseproxy instructions for the Apache2 charm.

Sample Graylog 2 vhost template for the apache2 charm:

$ cat graylog-vhost.tmpl
<Location "/">
    RequestHeader set X-Graylog-Server-URL "http://{{servername}}/api/"
    ProxyPass http://{{graylog_web}}/
    ProxyPassReverse http://{{graylog_web}}/
</Location>

<Location "/api/">
    ProxyPass http://{{graylog_api}}/api/
    ProxyPassReverse http://{{graylog_api}}/api/
</Location>

Sample Graylog 3 vhost template for the apache2 charm:

$ cat graylog-vhost.tmpl
<Location "/">
    RequestHeader set X-Graylog-Server-URL "http://{{servername}}/"
    ProxyPass http://{{graylog_web}}/
    ProxyPassReverse http://{{graylog_web}}/
</Location>

Now deploy and configure apache2 as your graylog reverse proxy:

juju deploy apache2
juju config apache2 "enable_modules='headers proxy_html proxy_http'"
juju config apache2 "vhost_http_template=$(base64 ./graylog-vhost.tmpl)"
juju expose apache2
juju relate apache2:reverseproxy graylog:website

Visit http://<apache2-public-ip> to access the Graylog web interface.

Scale out Usage

The MongoDB and Elasticsearch applications can both be scaled up or down. Graylog will reconfigure itself as needed. The Graylog charm does not yet support clustering of multiple units.

Configuration

Depending on the Elasticsearch charm used, the cluster name may not be passed to Graylog. In this case, the elasticsearch_cluster_name config option should be set.

Log Inputs

An optional config option, log_inputs, gives us the ability to specify additional Log Inputs. This requires a yaml list as input. The yaml can include four values: name, type, bind_address, and bind_port and can include multiple inputs. For example, to enable a Syslog UDP input, the yaml might look like this:

- name: SyslogUDP
  type: Syslog UDP
  bind_address: 0.0.0.0
  bind_port: 514

Upgrade

Graylog may be upgraded to a different snap version by setting the channel config option. For example, switch to the latest version 3 edge snap with the following:

juju config graylog channel='3/edge'

Note: When upgrading from Graylog version 2 to version 3, please consult the upgrade guide to ensure your environment meets the minimum requirements.

If a new channel config option results in a new snap being installed, the charm will backup the previous configuration file on the graylog unit in /var/snap/graylog/common/server.conf.$prev. This may be useful if graylog needs to be reverted to a previous version in the future.