How to Export Graylog Logs for Security Review
Summary
A practical guide to exporting Graylog messages through its REST API or underlying OpenSearch/Elasticsearch indices, then preparing them for review in LogTotal. It covers token authentication, index selection, timestamp formatting, and common errors.
Key points
- Graylog messages can be exported through its authenticated REST API or by querying the underlying OpenSearch or Elasticsearch indices.
- API authentication uses an access token as the username and the literal word “token” as the password; direct backend queries should use read-only access.
- Graylog streams map messages to index sets with their own prefixes and retention, so identify the relevant index set before querying.
- The examples filter by message source and UTC time range; backend queries use Graylog’s timestamp format and the default graylog_* index pattern.
- The guide says Graylog’s web-interface export format is not supported by LogTotal; it describes uploading an export for sanitization and review.
- For Graylog Cloud, the API route is available, while direct backend access is usually unavailable.
Article Details
- Defense Focus
- Export Graylog messages for sanitization and investigation in LogTotal.
- Detection Methods
- Export messages through the Graylog REST API using search filters for source and time range.
- Query Graylog backend indices directly with a filtered search and scan through matching records.
- Review the message field and, when available, full_message.
- Data Sources
- Graylog messages stored in OpenSearch or Elasticsearch indices
- Graylog streams and their associated index sets
- Platforms
- Graylog
- OpenSearch
- Elasticsearch
- LogTotal
- Defensive Actions
- Create a Graylog access token and use the documented token authentication format for API access.
- For direct backend access, request a read-only account from the cluster operator.
- Confirm which index set contains the relevant data and use the timestamp format expected by the backend.
- Sanitize the exported file before reviewing it in LogTotal.
Products
ElasticsearchGraylog keeps its messages in OpenSearch or Elasticsearch, so you have two routes.GraylogGraylog keeps its messages in OpenSearch or Elasticsearch, so you have two routes.LogTotalThe export in the Graylog web interface produces a format LogTotal doesn’t read today.OpenSearchGraylog keeps its messages in OpenSearch or Elasticsearch, so you have two routes.