Configure LLM Provider for Graylog Agents

The following section exclusively pertains to a Graylog Enterprise feature. To learn more about obtaining an Enterprise license, please contact the Graylog Sales team.

Before any Graylog Agent can run, you must configure the large language model (LLM) provider and model that it uses. The provider and model you select are a single, global setting that applies to every agent.

This article explains how to select an LLM provider, enter its credentials, choose a model, and test and save the connection. It also explains how to change or remove the configuration.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

Credentials for a supported LLM provider, or, if you use Ollama, a running Ollama instance.
Ensure you have the required role to access System > AI Management. For example, Agent Workflow Manager and Agent Workflow Reader]

Supported Providers

Graylog supports the following LLM providers:

Amazon Bedrock
Anthropic
Google
Mistral
Ollama
OpenAI

See Graylog Agentic Framework for guidance on choosing a provider, such as using Ollama to keep agent traffic inside your network.

Configure the Provider

To configure the LLM provider:

Navigate to System > AI Management. The Model Provider page opens.

If no provider is configured yet, you can also click Configure Provider in the Model provider configuration is missing message on the Workflows tab of Enterprise > AI Agent Workflows.
In the Provider list, select the LLM provider the agents should use.
Enter the credentials that the provider requires.
In the Model list, select a model. The list shows the models your account can use, as reported by the provider.
Click Test to confirm that Graylog can reach the provider.
Click Update provider to save the configuration.

Each workflow's page in Enterprise > AI Agent Workflows shows the Model and Provider it uses.

Important: If your provider retires the model you selected, agent workflows fail until you select a model the provider still offers.

Change or Remove the Provider

To replace a saved API key, click Reset key, enter the new key, and then click Update provider.
To switch to a different provider or model, repeat the steps in Configure the Provider.
To remove the configuration, click Delete provider in the Danger Zone section of the Model Provider page.

Warning: Deleting the provider configuration stops every agent workflow from running until a new provider is configured.

Next Steps

After the provider is configured, enable the agents you want to use. See Graylog Agents.