Log inSubmit server
Graylog MCP Server logo

Graylog MCP Server

Query, aggregate, and inspect Graylog logs through MCP, with stream and field discovery across multiple instances.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Graylog MCP Server

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "graylog-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@jperelli/graylog-mcp@latest"
      ],
      "env": {
        "GRAYLOG_BASE_URL_INSTANCE_N": "YOUR_VALUE_HERE",
        "GRAYLOG_API_TOKEN_INSTANCE_N": "YOUR_VALUE_HERE",
        "GRAYLOG_LABEL_INSTANCE_N": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

Graylog MCP Server MCP server connects MCP clients to one or more Graylog instances for log search and analysis. It provides tools to discover readable streams and indexed fields, search messages, aggregate matches by field, and retrieve individual documents. Searches use Graylog/Elasticsearch query syntax and can target relative or absolute time windows, with concise results by default. Use it when an agent needs to investigate application logs, compare environments, or identify log patterns without exposing every field in each result.

Use cases

  • Search recent application errors in Graylog
  • Discover readable Graylog streams and indexed fields
  • Aggregate errors by namespace, container, or other field
  • Inspect one matching log document in full
  • Compare logs across configured Graylog instances

Key features

  • Search Graylog messages with Graylog/Elasticsearch syntax
  • Aggregate matches by field with optional time histograms
  • List readable streams and indexed fields
  • Return concise or verbose message data
  • Query multiple labeled Graylog instances
  • Fetch individual documents in full

Tools35

What Graylog MCP Server lets your agent do. Expand a tool for its parameters.

Self-reported~72 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

9/9 checks healthy over the last 46d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 2d ago via OSV.dev · @jperelli/graylog-mcp@latest (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars2Stargazers on the source repository.
npm downloads267Package downloads in the last 30 days.
Last commit3mo agoMost recent push to the default branch.
Tools exposed35Callable tools this server registers over MCP.

How Graylog MCP Server works

What Graylog MCP Server MCP server does

Graylog MCP Server MCP server gives an MCP client read access to configured Graylog instances. It is designed for investigating logs rather than changing Graylog configuration. The server can discover streams visible to an API token, inspect fields present in the index, search matching messages, summarize matches by field, and retrieve one message as a complete document.

The search workflow supports both broad and targeted investigation. The Default Stream can cover everything the token is allowed to read, while named stream IDs restrict a request to particular streams. Results are merged newest-first. By default, search returns selected high-signal fields and truncates the raw message body; verbose output or an explicit field list can request more data.

How it works

The server runs as a JavaScript MCP process under Node.js 18 or later. An MCP client starts it with npx, and the process uses Graylog API tokens to query the configured endpoints. Multiple instances can be registered, each with a label that the client can use when choosing where to run a query.

A practical investigation often starts with list_streams or the Default Stream ID, followed by list_fields when a field name is uncertain. analyze can group matching records by a field and optionally produce a minute- or hour-based histogram. search is better suited to reading selected log lines after the relevant scope or pattern is known. get_message can then fetch a single hit in full.

Queries use Graylog/Elasticsearch syntax, including field filters, Boolean expressions, wildcards, and *. Search windows may be relative, using seconds, or absolute, using ISO-8601 UTC values.

Setup and configuration

Graylog MCP Server MCP server requires Node.js 18 or newer. No package installation is required when using the documented npx command: the MCP client downloads and runs @jperelli/graylog-mcp@latest.

Configure each instance with a numbered set of environment variables:

  • GRAYLOG_BASE_URL_INSTANCE_N: Graylog base URL; required.
  • GRAYLOG_API_TOKEN_INSTANCE_N: API token; required.
  • GRAYLOG_LABEL_INSTANCE_N: optional label, defaulting to instance_N.

Replace N with 1, 2, 3, and so on. An instance is active only when both its base URL and token are present. The README provides configurations for Claude Code, Cursor, and Claude Desktop.

Tools and capabilities

  • list_streams returns readable stream IDs and titles, with optional title filtering and result limits.
  • list_fields reports indexed field names and can filter them by a case-insensitive substring.
  • search reads matching records across required stream IDs and supports time ranges, result limits, field selection, and verbose output.
  • analyze aggregates matches by a selected field and can group results into minute or hour intervals.
  • get_message retrieves one matching document with its complete data.

The server also supplies client instructions covering query syntax, stream scoping, and severity-related behavior. Empty searches distinguish among an invalid query, a quiet time range, and logs that have not yet been indexed.

Limitations and notes

Search requires stream IDs; the server does not implicitly perform an all-stream query. Use the Default Stream ID to cover everything readable by the token, or call list_streams to find a named stream. A token with limited permissions may receive an authorization failure if a request targets inaccessible streams.

Field names and values must match data actually indexed by Graylog. Similar-looking fields may coexist while only one contains values, so list_fields and analyze with value filtering are useful before constructing a narrow query. Search output is intentionally compact unless verbose mode or explicit fields are requested.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Graylog MCP Server

Graylog MCP Server is an MCP server that connects AI clients to one or more Graylog instances through API tokens. Its main tools discover streams and fields, search messages, aggregate matches by field or time, and retrieve an individual message document for detailed inspection.

Run it with npx rather than installing it separately. Configure the server in an MCP client with `npx -y @jperelli/graylog-mcp@latest`, then provide a Graylog base URL and API token through the numbered environment variables.

Each active instance requires `GRAYLOG_BASE_URL_INSTANCE_N` and `GRAYLOG_API_TOKEN_INSTANCE_N`. `GRAYLOG_LABEL_INSTANCE_N` is optional and supplies the instance name shown to the client. Replace `N` with sequential numbers to configure multiple instances.

Yes, Cursor is documented as a supported MCP client. Add the server to `~/.cursor/mcp.json`, use the `npx` command, and set the Graylog URL, API token, and optional label in the environment configuration.

Related MCP servers

All in Monitoring All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewGraylog MCP Server AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/graylog-mcp-server?style=directory)](https://allmcps.com/mcp/graylog-mcp-server)
HTML Embed
<a href="https://allmcps.com/mcp/graylog-mcp-server"><img src="https://allmcps.com/api/badge/graylog-mcp-server?style=directory" alt="Graylog MCP Server on AllMCPs" /></a>