Salesforce Input

Salesforce provides business management, customer relationship management, and sales tools in an online Cloud platform. The Salesforce system generates various type of logs that Graylog can consume via the EventLogFile API. See the official documentation for all supported log event types.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

You must have a Salesforce subscription that includes the Salesforce Event Monitoring add-on, which is required to obtain all of the data presented in the app dashboards.

Supported Log Types

This input supports collecting the following log types:

Graylog currently supports all EventLogFile source types as of version 58 of the Salesforce EventLogFile API.

Required Third-Party Setup

To enable integration, complete the following required setup with your third-party service:

First, create a Connected App in the App Manager modal. (See the Salesforce documentation for more details.)
Ensure during this initial setup that the EventLogFile API has read permission for the Graylog application.
Then, configure OAuth for the Connected App, which will produce the Client ID and Secret that Graylog needs to successfully connect to the Salesforce API. (See the Salesforce documentation for more details.)

Required Configuration Values

In your third-party configuration, make note of the following values that are required when configuring the input in Graylog:

Consumer Key
Consumer Secret

Input Type

This input is a pull input type. See Inputs to learn about input types.

Input Configuration

Follow the input setup instructions. During setup of this input, you can configure the following options:

Configuration Option	Description
Input Name	Provide a unique name for your new input.
Base Salesforce URL	The full base Salesforce URL for your instance, e.g. `https://instance.my.salesforce.com`.
Consumer Key	The Consumer Key of Salesforce Connected App created with sufficient API permissions.
Consumer Secret	The Consumer Secret of the Salesforce Connected App.
Logs Types to Collect	The activity log for the above content types will be fetched.
Polling Interval	Determines how often Graylog will check for new data in Salesforce. The smallest allowable interval is 5 minute.
Enable Throttling	If enabled, no new messages will be read from this input until Graylog catches up with its message load. This is typically useful for inputs reading from files or message queue systems like AMQP or Kafka. If you regularly poll an external system, e.g. via HTTP, you normally want to leave this disabled.

Next Steps

After you complete input setup, visit Input Diagnosis for testing and validation of the new input. Use this functionality to help troubleshoot any connection issues.