Configure Collector Settings

In Graylog 7.2, Graylog Collector has been released as a preview feature for evaluation and feedback purposes. This feature's design and behavior could change significantly in future releases. To share feedback on your experience with Graylog Collector, email feedback@graylog.com.

The Collectors Settings tab is where you set or update the configuration that applies to every collector in your cluster. These settings cover where collectors send their data and how long Graylog keeps track of collectors that stop reporting. This article explains how to configure the ingest endpoint and how to set the collector lifecycle thresholds as well as which Graylog user roles are required to perform these actions.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

You must be a Graylog administrator to complete the initial setup because creating the collector ingest input requires permission to create inputs that the Collectors Manager role does not include.
Changing settings after the initial setup requires the Collectors Manager role.

Configure the Ingest Endpoint

Collectors send their log data over the OpenTelemetry Protocol (OTLP) to the ingest endpoint. Graylog pushes this address to every collector as its data destination, so the address has to be one the collector hosts can reach.

To configure the ingest endpoint, go to System > Collectors, then select the Settings tab:

Enter the External hostname that collectors connect to, which is typically a load balancer or the Graylog server's own hostname. Graylog prefills a value from your environment, but the prefilled value is not always reachable from collector hosts, so verify the hostname before saving.
Enter the External port. The default is 14401.

Keep the default value unless a load balancer or a network policy requires another port. The value set here is the port collectors connect to, which is not necessarily the port the input binds to.
Select Confirm settings.

The first time you save these settings, the page also offers Create ingest input. Leave this option selected so Graylog creates the input that receives collector data. Saving initializes the infrastructure Graylog uses to issue collector certificates. No collector can enroll until that initialization completes.

Warning: The hostname and port must resolve and route from every collector host. A collector whose control channel works but whose ingest endpoint is unreachable appears online and healthy while no data reaches Graylog.

The Ingest Inputs panel at the bottom of the settings page shows the input that receives the data, with its bind address and port. Its status counts Graylog nodes running the input, not collectors, so a three-node cluster reads "3 running" regardless of how many collectors are enrolled.

Graylog warns you if the port here does not match the port of any running collector ingest input. That mismatch is the most common reason collectors enroll successfully and then never deliver a message.

Configure Collector Lifecycle Thresholds

The settings in the Collector Lifecycle section control how Graylog presents and retains collectors that have stopped reporting. They change nothing about collector behavior on the host.

To change the thresholds, go to System > Collectors, then select the Settings tab:

Set the thresholds you want to change under Collector Lifecycle.
Select Confirm settings.

The Collector Lifecycle section includes the following settings:

Setting	Default	Description
Offline threshold	5 minutes	Shows a collector as offline after it has not reported for this long.
Default visibility	1 day	Hides a collector from the default view of the Instances tab after it has not reported for this long.
Expiration threshold	90 days	Permanently removes a collector from Graylog after it has not reported for this long.

Collectors report in every 30 seconds, so set the offline threshold comfortably above that or brief network interruptions will show hosts flapping between online and offline.

Set the expiration threshold above the longest outage you expect to tolerate, such as a maintenance window or a fleet of laptops that are off for a week. A collector removed by expiration disappears from the Instances tab, and one that comes back afterward re-enrolls only if it still holds a valid certificate.

Collector Roles and Permissions

Graylog Collector introduces two built-in roles, so day-to-day collector management does not require administrator access.

Role	What it allows
Collectors Manager	Full management of fleets, sources, collector instances, enrollment tokens, collector settings, and the recent activity feed.
Collectors Reader	Read-only access to fleets, sources, instances, collector settings, and the recent activity feed.

Three cases fall outside those roles.

Creating the collector ingest input during initial setup also needs the standard Graylog permission to create inputs, which Collectors Manager does not include, so an administrator has to do the first save.

To view a collector's own logs, a user must be a Graylog administrator, or a Graylog administrator must share access to the Collector System Logs stream with them. Neither Collectors role grants that access on its own, and the log links stay hidden until the stream is shared. See Manage Sharing.

Installing a collector on a host needs no Graylog permission at all. Whoever holds the enrollment token can install it.

Important: Collector entities cannot be shared with individual users or teams the way other Graylog entities can. Access granted by assigning the Collectors roles applies to all fleets.

Troubleshooting and Common Issues

The following section outlines troubleshooting steps for common issues to assist you in resolving potential challenges you may encounter.

No Messages from Online Collectors

A collector that shows Online with its configuration synced has a working control channel, which says nothing about the data channel. The two are separate connections to different addresses.

Work through the checks from the Graylog end first.

Check	What it tells you
Network I/O on the ingest input	Open Input Diagnosis for Collector Ingest (HTTP). Zero bytes in means nothing has reached the input, so the problem is the path rather than the data. See Input Diagnosis.
The fleet's sources	A fleet with no sources collects nothing, however healthy its collectors look. See Manage Collector Fleets.
Port reachability from a collector host	The control channel runs over HTTPS to the Graylog server URL, usually on 443. The data channel needs the ingest endpoint's port, usually 14401, which is frequently closed on managed networks even when the server itself is reachable.

On the collector host, the agent log records every failed delivery, with the exact URL it tried and why the attempt failed. It is at /var/lib/graylog-collector/logs/agent.log on Linux, C:\ProgramData\Graylog\Collector\logs\agent.log on Windows, and /Library/Application Support/Graylog/Collector/logs/agent.log on macOS.

Repeated entries naming the exporter and the ingest URL mean the collector is reading its sources correctly and cannot deliver.