Graylog Server Configuration Settings Reference

This directory contains binaries that are used by the Graylog server (relative or absolute).

A comma-separated list of content packs (files in content_packs_dir) that should be applied on the first start of Graylog.

The directory that contains content packs that should be loaded on the first start of Graylog

Determines whether content packs in content_packs_dir load automatically on the first start of Graylog.

This directory is used to store Graylog server state (relative or absolute).

Ignores any exceptions encountered when running migrations.

Use with caution! Skipping failing migrations can result in an inconsistent database state.

If you are running more than one instance of Graylog server, you have to select only one graylog-server node as the leader. This node performs periodic maintenance actions that replica nodes do not perform.

For replica nodes, set this value to false. Replica nodes accept messages the same as leader nodes. Nodes fall back to replica mode if there is already a leader in the cluster.

The auto-generated node ID is stored in this file and read after restarts. It is recommended to use an absolute file path here if you are starting Graylog from init scripts or similar.

Set plugin directory here (relative or absolute).

The email address of the root user.

The time zone setting of the root user. See this list of valid time zones.

The directory that is used to store the message journal. The directory must be exclusively used by Graylog and must not contain any files other than the ones created by Graylog itself.

Enables the disk-based message journal.

Sets a time interval at which Graylog forces an fsync of data written to the log. For example, if you set this value to 1000, Graylog would fsync after 1000 ms had passed.

Specifyies a message count at which Graylog forces an fsync of data written to the log. For example, if you set this value to 1, Graylog would fsync after every message; if it were 5, Graylog would fsync after every 5 messages.

The maximum time the journal holds messages before they are written to the search backend. Works with message_journal_max_size so that message writes are triggered by whichever property is hit first.

The maximum size the journal grows to before messages can be written to the search backend. Works with message_journal_max_age so that message writes are triggered by whichever property is hit first.

Controls the period of time after which Graylog forces the log to roll even if the segment file isn’t full to ensure that retention can delete or compact old data.

Sets the size of the journal segment.

Configures system-wide enabled TLS protocols. Only configure this if you need to support legacy systems. We maintain a secure default (currently TLS 1.2 and TLS 1.3).

Sets the network interface used by the Graylog HTTP interface. This address and port is used by default in the http_publish_uri. This network interface must be accessible by all Graylog nodes in the cluster and by all clients using the Graylog web interface. If the port is omitted, Graylog uses port 9000 by default.

The default connect timeout for outgoing HTTP connections. Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds).

Enables CORS headers for the HTTP interface. This setting is necessary for JavaScrip clients accessing the server directly. If this is disabled, modern browsers will not be able to retrieve resources from the server.

Compresses API responses and therefore helps to reduce overall round trip times.

Secures the communication with the HTTP interface with TLS to prevent request forgery and eavesdropping. Note that additional configuration is required.

Sets the public URI of Graylog, which is used by the Graylog web interface to communicate with the Graylog REST API. The external Graylog URI usually has to be specified if Graylog is running behind a reverse proxy or load-balancer and it will be used to generate URLs addressing entities in the Graylog REST API (see http_bind_address).

The maximum size of the HTTP request headers in bytes.

A list of hosts that should be reached directly, bypassing the configured proxy server. This value is a list of patterns separated by commas (,). The patterns can start or end with an asterisk (*) for wildcards. Any host matching one of these patterns will be reached through a direct connection instead of through a proxy.

Sets an HTTP proxy for outgoing HTTP connections.

Sets the HTTP URI of this Graylog node, which is used to communicate with the other Graylog nodes in the cluster and by all clients using the Graylog web interface. The URI is published in the cluster discovery APIs so that other Graylog nodes are able to find and connect to this Graylog node.

This setting has to be used if this Graylog node is available on a network interface other than http_bind_address, for example if the machine has multiple network interfaces or is behind a NAT gateway.

This setting must not be configured to a wildcard address! If http_bind_address contains a wildcard IPv4 address (0.0.0.0), http_publish_uri will be filled with the first non-loopback IPv4 address of this machine instead.

The default read timeout for outgoing HTTP connections. Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds).

The size of the thread pool used exclusively for serving the HTTP interface.

The X.509 certificate chain file in PEM format to use for securing the HTTP interface.

The PKCS#8 private key file in PEM format to use for securing the HTTP interface.

The password to unlock the private key used for securing the HTTP interface (if key is encrypted).

The default write timeout for outgoing HTTP connections. Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds).

How many seconds to wait between marking node as DEAD for possible load balancers and starting the actual shutdown process. Set this value to 0 if you have no status checking load balancers in front.

Journal usage percentage that triggers requesting throttling for this server node from load balancers. The feature is disabled if not set.

Connection timeout for a configured LDAP server (e. g., Active Directory) in milliseconds.

Number of threads used exclusively for dispatching internal events.

Enable to auto-restart manually stopped inputs.

The number of parallel running processors. Raise the number if your input buffer is filling up.

Optional limits on scheduling concurrency by job type. No more than the specified number of worker threads can execute jobs of the specified type across the entire cluster.

Batch size for the search backend output. This value is the maximum number of messages the search backend output module gets at once and writes to the search backend in a batch call. Alternatively, you can set the value to maximum size by including a size designation with the number, such as 10mb.

If the configured batch size has not been reached within the number of seconds set in output_flush_interval, everything that is available is flushed at once. Remember that every output buffer processor manages its own batch and performs its own batch write calls (see outputbuffer_processors).

Defines how many faults an output can have before not being tried again for a number of seconds set in output_fault_penalty_seconds.

Sets the delay in seconds to wait before retrying a failing output that has hit the output_fault_count_threshold.

Flushes interval (in seconds) for the search backend output. This value is the maximum amount of time between two batches of messages written to the search backend. It is effective only if your minimum number of messages for this time period is less than output_batch_size * outputbuffer_processors.

Sets the size of the thread pool in the output buffer processor.

The number of parallel running processors. By default, this value is determined automatically based on the number of CPU cores available. Set this value explicitly to override the dynamically calculated value. Raise the number if your buffers are filling up.

The number of parallel running processors. By default, this value is determined automatically based on the number of CPU cores available. Set this value explicitly to override the dynamically calculated value. Raise the number if your buffers are filling up.

Wait strategy describing how buffer processors wait on a cursor sequence. Possible types:

• yielding: Compromise between performance and CPU usage.

• sleeping: Compromise between performance and CPU usage. Latency spikes can occur after quiet periods.

• blocking: High throughput, low latency, higher CPU usage.

• busy_spinning: Avoids syscalls, which could introduce latency jitter. Best when threads can be bound to specific CPU cores.

Size of internal ring buffers. Raise this value if raising outputbuffer_processors does not help. For optimum performance, your LogMessage objects in the ring buffer should fit in your CPU L3 cache. Must be set to a power of 2 (512, 1024, 2048, …).

IP address and port for the Prometheus exporter HTTP server.

Enables the Prometheus exporter HTTP server.

Path to the Prometheus exporter core mapping file. If this option is enabled, the full built-in core mapping is replaced with the mappings in this file. This file is monitored for changes, and updates are applied at runtime.

Path to the Prometheus exporter custom mapping file. If this option is enabled, the mappings in this file are configured in addition to the built-in core mappings. Mappings in this file cannot overwrite any core mappings. This file is monitored for changes, and updates are applied at runtime.

Maximum number of attempts to connect to Data Node on boot. With the default, 0, Graylog retries indefinitely with the given delay until a connection is established.

Sets the wait time between connection attempts for datanode_startup_connection_attempts.

The default index prefix for Graylog events.

The default index prefix for Graylog system events.

Disables the optimization of search backend indices after index cycling. This process can take some load from the search backend on heavily used systems with large indices, but it will decrease search performance. The default is to optimize cycled indices.

This configuration list limits the retention strategies available for user configuration via the UI. The following strategies can be disabled:

• delete: Deletes the index completely (Default)

• close: Closes the index and hides it from the system. Can be re-opened later.

• none: No operation is performed. The index stays open. (Not recommended!)

Note that at least one strategy must be enabled. Be careful when extending this list on existing installations!

Analyzer (tokenizer) to use for message and full_message fields. The standard filter is usually best. All supported analyzers are: standard, simple, whitespace, stop, keyword, pattern, language, snowball, custom.

Note that this setting takes effect only on newly created indices.

Enables payload compression for search backend requests.

Maximum amount of time to wait for successful connection to the search backend HTTP port.

Disables checking the version of the search backend for compatibility with this Graylog release.

Sets the default scheme when connecting to the search backend discovered nodes. Available options: http, https

Enables automatic search backend node discovery through Nodes Info.

Filter for including or excluding search backend nodes in discovery according to their custom attributes.

Frequency of the search backend node discovery.

List of search backend hosts Graylog should connect to, specified as a comma-separated list of valid URIs for the HTTP ports of your search backend nodes. If one or more of your search backend hosts require authentication, include the credentials in each node URI that requires authentication.

Maximum idle time for a search backend connection. If this value is exceeded, the connection is torn down.

Maximum number of concurrently running index optimization (force merge) jobs. If you use many different index sets, you might need to increase this number.

Global timeout for index optimization (force merge) requests.

The prefix for the default Graylog index set.

Approximate maximum number of documents in a search backend index before a new index is created. Configure this value if you set rotation_strategy to count. See also no_retention and elasticsearch_max_number_of_indices.

Sets the number of indices to keep.

Maximum number of times Graylog retries failed requests to the search backend.

Approximate maximum size in bytes per search backend index on disk before a new index is created. Configure this value if you set rotation_strategy to size. See also no_retention and elasticsearch_max_number_of_indices.

Approximate maximum time before a new search backend index is created. Configure this value if you set rotation_strategy to time. Note that this rotation period does not look at the time specified in the received messages, but uses the real clock value to decide when to rotate the index!

Specify the time using a duration and a suffix indicating which unit you want:

• 1w = 1 week

• 1d = 1 day

• 12h = 12 hours

Permitted suffixes are: d for day, h for hour, m for minute, s for second.

See also no_retention and elasticsearch_max_number_of_indices.

Maximum number of total connections to the search backend.

Maximum number of total connections per search backend route (typically this means per search backend server).

Optional upper bound on elasticsearch_max_time_per_index.

Mutes the logging-output of search backend deprecation warnings during REST calls in the search backend REST client.

The number of replicas for your indices. A good setting here highly depends on the number of nodes in your search backend cluster.

Controls whether empty indices are rotated. Applies only if rotation_strategy is set to time.

The number of shards for your indices. A good setting here highly depends on the number of nodes in your search backend cluster.

Maximum amount of time to wait for reading back a response from a search backend server.

Name of the search backend index template used by Graylog to apply the mandatory index mapping.

Enables use of Expect: 100-continue header for search backend index requests. If this setting is disabled, Graylog cannot properly handle HTTP 413 Request Entity Too Large errors.

Maximum number of attempts to connect to the search backend on boot for the version probe.

Sets the wait time between connection attempts for elasticsearch_version_probe_attempts.

Sets which rotation options are available through the UI. The options available to set are:

• time-size-optimizing: Tries to rotate daily while focussing on optimal sized shards. Configure the global default values with time_size_optimizing_retention_min_lifetime and time_size_optimizing_retention_max_lifetime.

• count: Number of messages per index. Use elasticsearch_max_docs_per_index to set the number.

• size: Size per index. Use elasticsearch_max_size_per_index to set the size.

• time: Time interval between index rotations. Use elasticsearch_max_time_per_index to set the time.

A strategy can be disabled by specifying the optional enabled_index_rotation_strategies list and excluding that strategy.

Time interval to trigger a full refresh of the index field types for all indexes. This option queries the search backend for all indexes and populate any missing field type information to the database.

Optimize the index down to <= index_optimization_max_num_segments. A higher number can take some load from the search backend on heavily used systems with large indices, but it will decrease search performance.

Time interval for index range information cleanups. This setting defines how often stale index range information is purged from the database.

Provides a hard upper limit for the retention period of any index set at configuration time. This setting is used to validate the value a user chooses for the maximum number of retained indexes when configuring an index set. However, it is only in effect when a time-based rotation strategy is chosen.

If a rotation strategy other than time-based is selected or if no value is provided for this setting, no upper limit for index retention is enforced.

Disables message retention on this node—that is, disables the search backend index rotation.

Determines what happens with the oldest indices when the maximum number of indices is reached. The following strategies are available:

• delete: Deletes the index completely (Default)

• close: Closes the index and hides it from the system. Can be re-opened later.

Allows searches to be highlighted. Depending on message sizes, this setting can use a lot of memory and should be enabled only after making sure your search backend cluster has enough memory.

Allows searches to begin with wildcard characters. Such searches can use a lot of resources and should only be enabled with care.

Sets how often the Welcome screen content feed checks for new posts. See content_stream_rss_url.

URL for the content feed that appears on the Welcome screen.

The default cache time for dashboard widgets. The minimum setting is 1 second.

Maximum value that can be set for an event limit.

Sets field value suggestion mode. The possible values are:

• off: Field value suggestions are turned off.

• textual_only: Field values are suggested only for textual fields.

• on: Field values are suggested for all field types, even the types where suggestions are inefficient performance-wise (Default).

Enables Graylog to periodically investigate indices to determine which fields are used in which streams. Therefore, field lists in the Graylog interface show only fields used in selected streams. This option can decrease system performance, especially on systems with a large number of streams and fields.

Optional allowed paths for Graylog data files. If provided, certain operations in Graylog are permitted only if the data file(s) are located in the specified paths (for example, with the CSV File lookup adapter). All sub-directories of indicated paths are allowed by default. This option provides an additional layer of security and allows administrators to control where in the file system Graylog users can select files from.

Disable the use of OSHI for collecting system stats.

Time in milliseconds to wait for all message outputs to finish writing a single message.

Time in milliseconds to wait for all message outputs to finish writing a single message.

Controls how often processing status information is written to the database. Values must be a positive duration and cannot be less than 1 second.

Configures the threshold for detecting outdated processing status records. Any records that have not been updated in the configured threshold time are ignored. Values must be a positive duration and cannot be less than 1 second.

The default HTTP call timeout for cluster-related REST requests. This timeout might be overriden for some resources in code or other configuration values. (Some cluster metrics resources use a lower timeout value.)

For some cluster-related REST requests, the node must query all other nodes in the cluster. This value is the maximum number of threads available for this process. Increase the value if /cluster/* requests take too long to complete.

The value should be http_thread_pool_size * average_cluster_size if you have a high number of concurrent users.

Time in milliseconds after which a detected stale leader node is rechecked on startup.

Sets the maximum number of times a stream can timeout before it is disable and a notification shown in the web interface. See also stream_processing_timeout.