Graylog REST API

Name: Graylog REST API
Brand: Graylog REST API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring ObservabilityapiKey,basic,bearer98 EndpointsREST

For Agents

Run searches across log streams, manage Graylog inputs, streams, dashboards, alerts, and pipelines, and administer users and content packs.

Connect the Graylog REST API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Graylog REST API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Graylog REST API.

Run a relative, absolute, or keyword universal search across the cluster's log data

Inspect and manage the cluster's nodes via /system/cluster/nodes

Create or list Graylog inputs that feed messages into the cluster

Build and modify streams that route messages to dashboards and alerts

GET STARTED

Start building with Graylog REST API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use Graylog REST API for, with concrete tasks.

★ Incident Triage with Saved Searches

On-call engineers run keyword and absolute time-range searches against /search/universal endpoints to pinpoint the first occurrence of an error during an incident. Streams and pipelines pre-filter the relevant data so search latency stays low even on a busy cluster.

POST to /search/universal/keyword with query='error 500' and a 30-minute relative range, then summarize the top 10 source hosts

Ingestion Pipeline Management

Platform teams use the Inputs and Pipelines surfaces to provision new ingestion paths, attach processing rules, and verify lookup tables in production without touching the Graylog UI. The /system/inputs endpoints let automation create a syslog or beats input for a new application as part of an onboarding workflow.

POST a new GELF UDP input to /system/inputs and verify it appears in the response of GET /system/inputs

Cluster Health Monitoring

SREs monitor cluster health by polling /system/cluster/nodes and comparing returned node states against the expected fleet. Changes in node count or node state feed alerts that wake the on-call rotation before user-visible search performance degrades.

GET /system/cluster/nodes and raise an alert if any node's state is not 'CONNECTED'

Agent-Driven Observability Assistant via Jentic

An AI observability assistant uses Jentic to discover the right Graylog operation when an engineer asks 'what errors did we see in the last hour?' or 'is the kafka input still up?'. Jentic injects the configured auth scheme so the agent never holds the bearer token or session cookie.

Search Jentic for 'search graylog logs', load the schema for /search/universal/relative, and execute it with the user's query and time range

Key Endpoints

98 endpoints — jentic publishes the only available openapi specification for graylog rest api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/search/universal/relative

Search with a rolling time range

POST

/search/universal/absolute

Search with absolute start and end timestamps

POST

/search/universal/keyword

Search with a Graylog time keyword

GET

/system/cluster/nodes

List nodes in the cluster

GET

/system/inputs

List configured inputs

POST

/system/inputs

Create a new input

POST

/search/universal/relative

Search with a rolling time range

POST

/search/universal/absolute

Search with absolute start and end timestamps

POST

/search/universal/keyword

Search with a Graylog time keyword

GET

/system/cluster/nodes

List nodes in the cluster

GET

/system/inputs

List configured inputs

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Graylog basic auth credentials, bearer tokens, or session tokens are stored encrypted in the Jentic vault. Jentic injects the right header — Authorization or X-Requested-By — at execution time so the agent never sees the raw secret.

Intent-based discovery

Agents search Jentic by intent (e.g., 'search graylog logs') and Jentic returns the matching operation with its schema, so the agent can target /search/universal or /system/inputs directly.

Time to first call

Direct Graylog integration: 1-2 days to wire one of three auth schemes plus retries against the self-hosted cluster. Through Jentic: under 1 hour — search, load schema, execute.

FAQs

Specific to using Graylog REST API through Jentic.

Why is there no official OpenAPI spec for Graylog REST API?

Graylog publishes a Swagger description through its admin UI but does not ship an externally maintained OpenAPI 3 file for automation use. Jentic generates and maintains this spec so that AI agents and developers can call Graylog REST API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Graylog REST API use?

Graylog supports three schemes on these endpoints: HTTP basic auth with a username and password, a bearer token from a session, or a session token paired with the X-Requested-By header. Through Jentic the chosen credential is stored in the vault and the X-Requested-By header is added automatically when needed.

Can I run a time-range search across all my logs?

Yes. POST to /search/universal/relative for a rolling window such as the last 15 minutes, /search/universal/absolute for a fixed start and end timestamp, or /search/universal/keyword for a Graylog-style time keyword like 'yesterday'. Each accepts a query string, optional stream filters, and a result limit.

What are the rate limits for the Graylog REST API?

Graylog is typically self-hosted, so there is no vendor-imposed rate limit. Practical limits come from the cluster's compute and storage capacity. For automation, restrict expensive search calls to narrow time ranges and use streams to pre-filter data rather than running broad universal searches.

How do I create a new input through Jentic?

Search Jentic for 'create graylog input', load the operation that maps to POST /system/inputs, and execute it with the input type, configuration, and global flag. The response includes the new input id, which you can then read back via GET /system/inputs/{inputId} to confirm it started.

Does the API expose alert definitions and event notifications?

Yes. The Events tag covers alert definitions and notifications, and the Streams tag exposes the streams those alerts evaluate. Use these surfaces to script alert lifecycle changes during deployments and to automate exporting alert configuration into version control.

Graylog REST API

Connect the Graylog REST API to your agent

Capabilities

Start building with Graylog REST API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs