PostgreSQL Content Pack

The following content pack is available for use with a Graylog Illuminate license and Graylog Enterprise or Graylog Security. Contact sales to learn more about obtaining Illuminate.

PostgreSQL is an open-source relational database management system designed for reliability, standards compliance, and extensibility. It supports advanced data types, complex queries, transactional integrity, and robust access controls. PostgreSQL generates detailed operational, authentication, and query logs that can be parsed and enriched for monitoring and security analysis. This ability enables efficient search, correlation, and detection of database activity across diverse environments.

Requirements

• Graylog 7.1+ with a valid Enterprise license

• PostgreSQL with logging_collection on

• Graylog Sidecar or standalone Filebeat agent installed on PostgreSQL system(s)

Log Collection and Delivery

This pack was designed to use the Elastic Filebeat agent for log delivery. You can configure this integration using Graylog Sidecar. Collection of PostgreSQL logs should be performed from the manager and all agents.

This configuration requires that the account used to run the Graylog Sidecar/Filebeat agent has the necessary permissions to access the PostgreSQL log files. When running Sidecar/Filebeat with a non-root service account, you must grant that service account access to the log files.

Configuring PostgreSQL

PostgreSQL should be configured to generate stderr-formatted events. The jsonlog format is in beta and not fully tested. To use it, set the event_source_product in the filebeat configuration file to postgresql_json. The csvlog and syslog format are not supported.

Configuring Sidecar

1. Refer to the official documentation to set up Graylog Sidecar for Filebeat.

2. Create a matching Beats input in Graylog.

3. Ensure that the option Do not add Beats type as prefix is disabled.

4. Add the following example configuration snippet to your Filebeat configuration:

   Copy

   - type: filestream
   id: postgresql-filestream
   enabled: true
   paths:
   # Default PostgreSQL log paths (Debian/Ubuntu)
   - /var/log/postgresql/*.log
   # Default PostgreSQL log paths (RHEL/CentOS)
   - /var/lib/pgsql/data/log/*.log
   fields_under_root: true
   fields:
   event_source_product: postgresql

Hint: The configuration snippet provided is not a fully functional Filebeat configuration. It is only the section that adds PostgreSQL log ingestion to an existing configuration using the default PostgreSQL paths.

PostgreSQL Logs Format Examples

PostgreSQL has two log types. Some logs are directly related to database activities like updating a table, others are about the status of the database. Logs can be parsed with and without the header.

database.commands

statement: CREATE ROLE myuser GRANT analyst TO postgres; INSERT INTO dml_test VALUES (1); statement: INSERT INTO sales_archive SELECT * FROM sales WHERE sale_date < '2025-01-01'; 2026-02-13 05:02:38.447 GMT [1492] user=etl_user db=warehouse app=psql - CONN:1332777 client=10.10.5.23 LOG: statement: INSERT INTO sales_archive SELECT * FROM sales WHERE sale_date < '2025-01-01';

status.messages

connection authorized: user=postgres database=postgres application_name=pgAdmin 4 - DB:postgres

GIM Categorization - PostgreSQL logs

Categorization is assigned according to the vendor_event_action value.

vendor_event_action	Event Description	gim_event_type_code	gim_event_category	gim_event_subcategory	gim_event_type
ALTER ROLE	Database role database was modified	111000	iam	iam.object modify	account modified
ALTER TABLE	Database table structure was modified	159999	database	database.default	database message
authentication failed	Database user authentication attempt failed	100500	authentication	authentication.credential validation	credential validation
authorization denied	Database authorization request was denied	100000	authentication	authentication.logon	logon
connection authenticated	Database connection was successfully authenticated	100500	authentication	authentication.credential validation	credential validation
connection authorized	Database connection was successfully authorized	100000	authentication	authentication.logon	logon
connection received	Incoming database connection was received	120200	network	network.open	network connection initiated
CREATE	Database object creation was performed	159999	database	database.default	database message
CREATE DATABASE	New database was successfully created	151002	database	database.add	create database
CREATE ROLE	New database role was successfully created	110000	database	iam.object modify	account modified
CREATE TABLE	New database table was successfully created	151001	database	database.add	add table
DELETE FROM	Database records were deleted from table	151500	database	database.delete	delete rows
disconnection	Database client disconnected from server	102501	authentication	authentication.logoff	session disconnect
DROP DATABASE	Existing database was permanently removed	151502	database	database.delete	drop database
DROP ROLE	Existing database role was removed	110500	database	iam.object modify	account modified
DROP TABLE	Existing database table was removed	151501	database	database.delete	drop table
DROP USER	Existing database role was removed	110500	database	iam.object modify	account modified
failed authentication	Database authentication attempt was unsuccessful	100500	authentication	authentication.credential validation	credential validation
GRANT	Database privileges were granted to role	111000	iam	iam.object modify	account modified
INSERT INTO	New records were inserted into table	151000	database	database.add	insert rows
log in	User successfully logged into database	100501	authentication	authentication.credential validation	error
permission denied	Database permission request was denied	100501	authentication	authentication.credential validation	error
RESET	Database session database was reset	159999	database	database.default	database message
REVOKE	Database privileges were revoked from role	159999	database	database.default	database message
SELECT	Database records were queried from table	150000	database	database.query	database query
SET	Database session database was changed	159999	database	database.default	database message
shut down	Database system was shut down	210100	service	service.stop	service stopped
terminating connection	Database connection was forcibly terminated	120300	network	network.close	network connection ended
TRUNCATE	Database table contents were truncated	151500	database	database.delete	delete rows
TRUNCATE TABLE	Database table contents were truncated	151500	database	database.delete	delete rows
UPDATE	Database records were updated in table	150500	database	database.update	update rows

Message Fields Included in This Pack

Most relevant PostgreSQL fields are listed below.

PostgreSQL Log Field Normalization

Used Database Fields:

Original Field Name	Field Name	Example Value	Field Type	Description
action	vendor_event_action	INSERT, SELECT	string	Native action
application_name	application_name	pgAdmin 4	string	Client application name
client	source_ip	::1	string	Client source IP address
db	db_database_name	postgres	string	The database name
db_aggregate	db_aggregate	sum	string	The database aggregate function name
db_column	db_column	customer_id	string	The column name referenced in a database statement
db_constraint	db_constraint	orders_pkey	string	The database constraint name
db_constraint_type	db_constraint_type	PRIMARY KEY	string	The type of database constraint such as PRIMARY KEY or FOREIGN KEY
db_datatype	db_datatype	VARCHAR(255)	string	The data type defined or modified in a database statement
db_default	db_default	now()	string	The default value defined for a column
db_extension	db_extension	hstore	string	The database extension name
db_foreign_table	db_foreign_table	remote_orders	string	The foreign table name defined via foreign data wrapper
db_function	db_function	calculate_tax	string	The database function name
db_index	db_index	idx_orders_created_at	string	The database index name
db_new_column	db_new_column	tracking_id	string	The new column name after rename or creation
db_new_database_name	db_new_database_name	inventory	string	The new database name after rename
db_new_owner	db_new_owner	app_user	string	The new owner assigned to a database object
db_new_table	db_new_table	orders_archive	string	The new table name after rename
db_old_column	db_old_column	old_status	string	The previous column name before rename or alteration
db_old_table	db_old_table	orders_backup	string	The previous table name before rename
db_parameter	db_parameter	log_statement	string	The configuration parameter name modified in a statement
db_policy	db_policy	user_isolation	string	The row-level security policy name
db_procedure	db_procedure	update_account_balance	string	The database procedure name
db_publication	db_publication	orders_pub	string	The logical replication publication name
db_schema	db_schema	public	string	The database schema name
db_sequence	db_sequence	order_id_seq	string	The database sequence name
db_server	db_server	foreign_srv_1	string	The foreign server name used for external connections
db_source_table	db_source_table	sales	string	The source table used in statements like INSERT ... SELECT or CREATE TABLE AS
db_subscription	db_subscription	orders_sub	string	The logical replication subscription name
db_table_name	db_table_name	orders	string	The database table name
db_trigger	db_trigger	update_timestamp	string	The database trigger name
db_type	db_type	status_enum	string	The database type name such as ENUM or composite type
db_view	db_view	active_users	string	The database view name
db_where_column	db_where_column	sale_date	string	The column referenced in a WHERE clause
db_where_value	db_where_value	2025-01-01	string	The value used in a WHERE clause condition
db_with_options	db_with_options	fillfactor=70	string	The WITH clause options defined in a statement
error_severity	vendor_event_severity	ERROR	string	PostgreSQL native severity level
file_line_num	source_file_line	1072	long	Source code line number
file_name	file_name	postgres.c	string	Source code file generating log
func_name	source_function	exec_simple_query	string	PostgreSQL internal function name
Mapped	event_category	database	string	Normalized event category
Mapped	event_error_description	invalid_password	string
Mapped	event_outcome	failure	string	Derived event outcome
Mapped	event_severity	error	string	Normalized event severity
Mapped	event_severity_level	3	long	Mapped numeric severity level
pid	process_id	2310	long	PostgreSQL backend process ID
port	source_port	58806	long	Client source port
query_id	db_query_id	123456789	long	PostgreSQL query identifier
remote_host	source_ip	10.10.5.21	string	Remote client IP address
remote_port	source_port	55151	long	Remote client port
session_id	session_id	6971a5f3.1898	string	PostgreSQL session identifier
session_start	session_start	2026-01-22 04:22:11 GMT	string	Session start time
sql_state_code	event_error_code	42804	string	PostgreSQL SQLSTATE error code
target_user	target_user_name	John	string	If an administrator changes the user John, John is the target_user_name
timestamp	event_created	2026-01-13 07:01:11.112 GMT	string	Original PostgreSQL log timestamp
txid	transaction_id	0	long	Transaction ID
user	user_name	postgres	string	It is the user that does an activity.
vtxid	virtual_transaction_id	1/7	string	Virtual transaction ID