# Graylog MCP Server [Health: Active]

**Category:** 📊 Monitoring  
**Repository:** https://github.com/jperelli/graylog-mcp  
**GitHub Stars:** 2  
**npm Downloads (last month):** 267  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/graylog-mcp-server

## Description
Query logs from Graylog: get streams, search messages, aggregate, and get full data.

## Tools
Capabilities this server exposes over MCP:

- **instance**
- **titleContains**
- **catalogue**
- **limit**
- **contains**
- **namespace**
- **pod**
- **level**
- **query**
- **streams**
- **list_streams**
- **searchTimeRangeInSeconds**
- **from**
- **to**
- **searchCountLimit**
- **messageChars**
- **verbose**
- **false**
- **fields**
- **list_fields**
- **analyze**
- **field**
- **source**
- **namespace_name**
- **container_name**
- **valueContains**
- **size**
- **histogramInterval**
- **minute**
- **hour**
- **day**
- **week**
- **month**
- **messageId**
- **index**

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "graylog-mcp-server": {
    "command": "npx",
    "args": ["-y","@jperelli/graylog-mcp@latest"],
    "env": {
      "GRAYLOG_BASE_URL_INSTANCE_N": "",
      "GRAYLOG_API_TOKEN_INSTANCE_N": "",
      "GRAYLOG_LABEL_INSTANCE_N": ""
    }
  }
}
```

**Requires environment variables:** `GRAYLOG_BASE_URL_INSTANCE_N`, `GRAYLOG_API_TOKEN_INSTANCE_N`, `GRAYLOG_LABEL_INSTANCE_N` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What Graylog MCP Server MCP server does

Graylog MCP Server MCP server gives an MCP client read access to configured Graylog instances. It is designed for investigating logs rather than changing Graylog configuration. The server can discover streams visible to an API token, inspect fields present in the index, search matching messages, summarize matches by field, and retrieve one message as a complete document.

The search workflow supports both broad and targeted investigation. The Default Stream can cover everything the token is allowed to read, while named stream IDs restrict a request to particular streams. Results are merged newest-first. By default, search returns selected high-signal fields and truncates the raw message body; verbose output or an explicit field list can request more data.

## How it works

The server runs as a JavaScript MCP process under Node.js 18 or later. An MCP client starts it with `npx`, and the process uses Graylog API tokens to query the configured endpoints. Multiple instances can be registered, each with a label that the client can use when choosing where to run a query.

A practical investigation often starts with `list_streams` or the Default Stream ID, followed by `list_fields` when a field name is uncertain. `analyze` can group matching records by a field and optionally produce a minute- or hour-based histogram. `search` is better suited to reading selected log lines after the relevant scope or pattern is known. `get_message` can then fetch a single hit in full.

Queries use Graylog/Elasticsearch syntax, including field filters, Boolean expressions, wildcards, and `*`. Search windows may be relative, using seconds, or absolute, using ISO-8601 UTC values.

## Setup and configuration

Graylog MCP Server MCP server requires Node.js 18 or newer. No package installation is required when using the documented `npx` command: the MCP client downloads and runs `@jperelli/graylog-mcp@latest`.

Configure each instance with a numbered set of environment variables:

- `GRAYLOG_BASE_URL_INSTANCE_N`: Graylog base URL; required.
- `GRAYLOG_API_TOKEN_INSTANCE_N`: API token; required.
- `GRAYLOG_LABEL_INSTANCE_N`: optional label, defaulting to `instance_N`.

Replace `N` with `1`, `2`, `3`, and so on. An instance is active only when both its base URL and token are present. The README provides configurations for Claude Code, Cursor, and Claude Desktop.

## Tools and capabilities

- `list_streams` returns readable stream IDs and titles, with optional title filtering and result limits.
- `list_fields` reports indexed field names and can filter them by a case-insensitive substring.
- `search` reads matching records across required stream IDs and supports time ranges, result limits, field selection, and verbose output.
- `analyze` aggregates matches by a selected field and can group results into minute or hour intervals.
- `get_message` retrieves one matching document with its complete data.

The server also supplies client instructions covering query syntax, stream scoping, and severity-related behavior. Empty searches distinguish among an invalid query, a quiet time range, and logs that have not yet been indexed.

## Limitations and notes

Search requires stream IDs; the server does not implicitly perform an all-stream query. Use the Default Stream ID to cover everything readable by the token, or call `list_streams` to find a named stream. A token with limited permissions may receive an authorization failure if a request targets inaccessible streams.

Field names and values must match data actually indexed by Graylog. Similar-looking fields may coexist while only one contains values, so `list_fields` and `analyze` with value filtering are useful before constructing a narrow query. Search output is intentionally compact unless verbose mode or explicit fields are requested.

_Full upstream README: https://allmcps.com/mcp/graylog-mcp-server/readme_