Graylog Notes

1 URLs

• Swagger UI: http://graylog:12900/api/api-browser/

2 Ansible Roles

• https://github.com/uniQconsulting-ag/ansible.graylog3
• https://github.com/joe-speedboat/ansible.graylog2
• https://github.com/graylog-labs/graylog2-web-interface/issues/620

3 Notes

3.1 Grant Search access to read only users

• https://github.com/graylog-labs/graylog2-web-interface/issues/620
• Tested with v2.4.6 on CentOS7

grep api /etc/graylog/server/server.conf
  rest_listen_uri = http://10.0.5.7:12900/api/
  rest_transport_uri = http://10.0.5.7:12900/api/

curl -u b2471 -v -XPOST -H 'Content-Type: application/json' 'http://10.0.1.27:12900/api/roles/' -d '{"read_only": false,"permissions": ["searches:absolute", "searches:keyword", "searches:relative", "streams:read"],"name": "Global Search","description": "Permission to perform global search"}'
  Enter host password for user 'b2471':
  * About to connect() to 10.0.1.27 port 12900 (#0)
  *   Trying 10.0.1.27...
  * Connected to 10.0.1.27 (10.0.1.27) port 12900 (#0)
  * Server auth using Basic with user 'b2471'
  > POST /api/roles/ HTTP/1.1
  > Authorization: Basic YjI0NzE6SDBpcmVrYSEhIQ==
  > User-Agent: curl/7.29.0
  > Host: 10.0.1.27:12900
  > Accept: */*
  > Content-Type: application/json
  > Content-Length: 192
  > 
  * upload completely sent off: 192 out of 192 bytes
  < HTTP/1.1 201 Created
  < Location: http://10.0.1.27:12900/api/roles/Global%20Search2
  < X-Graylog-Node-ID: 7a1e48e4-f742-4c82-ac65-6973f17f6e85
  < Content-Type: application/json
  < Date: Thu, 01 Nov 2018 10:27:21 GMT
  < Content-Length: 185
  < 
  * Connection #0 to host 10.0.1.27 left intact
 {"name":"Global Search","description":"Permission to perform global search","permissions":["streams:read","searches:keyword","searches:relative","searches:absolute"],"read_only":false}