Graylog MCP Server — 12 AI Tools | Claude, ChatGPT & More

Graylog MCP ServerGraylog MCP server with 12 ready-to-use AI tools. Connect Graylog to Claude, ChatGPT, Gemini, or any MCP-compatible AI assistant. Cloud MCP connector — no install, no Docker, works from any browser.Category: Developer Tools. 12 tools available. Authentication: API Key.Search your logs with questions, not Lucene queriesWhy Graylog + AI?Graylog holds millions of log entries, but finding the right ones means writing Lucene queries and configuring time ranges. Describe what you are looking for in plain English and let AI write the search for you.Example prompts you can send your AI about Graylog

Ask: "Show me all 500 errors from the API gateway in the last hour"
AI does: AI constructs the right Lucene query, searches the correct stream, and returns matching log entries with timestamps and sources.

Ask: "What are the top 10 error messages in the last 24 hours?"
AI does: AI runs an aggregation query, groups by message content, and shows the most frequent errors ranked by count.

Ask: "Is the cluster healthy? How many messages per second are we processing?"
AI does: AI checks the Graylog health endpoint and reports throughput, journal status, and node health.

Ask: "List all active streams and how many messages each received today"
AI does: AI fetches streams with their rules and throughput stats for the current day.

Featured Graylog Tools

graylog_search_messages: Search Graylog log messages using Lucene query syntax. Returns matching log entries with timestamps, source, message, level, and all indexed fields. Maximum 150 results per query (use offset for pagination). WHEN TO USE: "Search logs for errors", "Show me recent 500 errors", "Find logs from server X", "What happened in the last 5 minutes?", "Show me nginx access logs", "Find connection refused messages", or any request to look at raw log messages. QUERY SYNTAX (Lucene): Field match: source:webserver01. Wildcard: source:web*. Boolean: source:web01 AND level:ERROR. Range: http_response_code:[500 TO 599]. Exists: _exists_:error_message. NOT: NOT level:DEBUG. Phrase: message:"connection refused". Default field is "message" when no field is specified. TIMERANGE formats: relative: {"type":"relative","range":300} (seconds). absolute: {"type":"absolute","from":"2024-01-01T00:00:00.000Z","to":"2024-01-02T00:00:00.000Z"}. keyword: {"type":"keyword","keyword":"last 5 minutes"}. COMMON RELATIVE RANGES: 300 (5min), 900 (15min), 1800 (30min), 3600 (1h), 14400 (4h), 86400 (24h), 604800 (7d). CRITICAL: The "range" value in relative timerange is in SECONDS, not minutes. WRONG: {"type":"relative","range":5} for 5 minutes. CORRECT: {"type":"relative","range":300} for 5 minutes. EXAMPLES: Recent errors: query="level:ERROR", timerange={"type":"relative","range":3600}. Nginx 5xx errors: query="source:nginx AND http_response_code:[500 TO 599]", timerange={"type":"relative","range":1800}. Specific host logs: query="source:web-prod-01", timerange={"type":"relative","range":900}. STEP-BY-STEP for incident investigation: 1. graylog_search_messages with query="level:ERROR" and short timerange to see recent errors. 2. Identify the source/pattern from results. 3. Narrow search with specific source or message pattern. 4. Use graylog_search_aggregate to count error trends over time.

graylog_search_aggregate: Run aggregations on Graylog log data to compute statistics like count, average, sum, min, max, or cardinality, optionally grouped by fields or time intervals. Returns computed metrics with grouping keys. Use this instead of graylog_search_messages when you need trends, counts, or statistics rather than raw log lines. WHEN TO USE: "How many errors in the last hour?", "Show me error trends over time", "Top sources by log volume", "What is the average response time?", "Count unique IPs", "Graph errors per minute", "Which servers generate the most logs?", or any question about log statistics, trends, or top-N analysis. METRIC FUNCTIONS: count (no field needed), avg, sum, min, max, stddev, card (unique count), percentile (requires percentile param, e.g. 95), latest. GROUP BY: By field: {"field":"source","limit":10} = top 10 sources. By time: {"field":"timestamp","interval":"1h"} = hourly buckets. Intervals: "1m", "5m", "15m", "1h", "6h", "1d". Multiple groups: group by source AND time simultaneously. CRITICAL: When grouping by time, the field MUST be "timestamp" (not "time" or "@timestamp"). CRITICAL: The "range" in timerange is in SECONDS. WRONG: range=5 for 5 minutes. CORRECT: range=300 for 5 minutes. EXAMPLES: Count errors per hour: query="level:ERROR", timerange={"type":"relative","range":86400}, group_by=[{"field":"timestamp","interval":"1h"}], metrics=[{"function":"count"}]. Top 10 sources by error count: query="level:ERROR", timerange={"type":"relative","range":3600}, group_by=[{"field":"source","limit":10}], metrics=[{"function":"count"}]. Average response time by endpoint: query="*", timerange={"type":"relative","range":3600}, group_by=[{"field":"http_path","limit":20}], metrics=[{"function":"avg","field":"response_time"}]. P95 response time trend: query="*", timerange={"type":"relative","range":86400}, group_by=[{"field":"timestamp","interval":"1h"}], metrics=[{"function":"percentile","field":"response_time","percentile":95}]. STEP-BY-STEP for performance analysis: 1. graylog_search_aggregate with count grouped by source to find top talkers. 2. graylog_search_aggregate with avg/p95 grouped by timestamp to see trends. 3. graylog_search_messages to inspect specific outlier messages.

graylog_health_check: Verify the connection to the Graylog instance and retrieve system information. Returns Graylog version, cluster ID, node ID, hostname, operating system, JVM info, processing status (is the node actively processing messages), and load balancer status. ALWAYS call this tool FIRST when starting a new Graylog session to confirm the connection works before running any other Graylog tools. If this fails, the credentials are wrong or Graylog is unreachable. WHEN TO USE: "Is Graylog running?", "Check Graylog connection", "What version of Graylog?", "Show me Graylog system info", "Is log ingestion working?", or at the start of any Graylog troubleshooting session.

graylog_list_streams: List all available Graylog log streams. Returns stream ID, name, description, active/disabled status, number of routing rules, and creation date. Streams are logical groupings that route log messages based on rules (e.g., all nginx logs go to the "Web Servers" stream, all firewall logs go to the "Security" stream). WHEN TO USE: "What streams are configured?", "Show me log streams", "What log categories do we have?", "Which streams are active?", or when you need a stream ID to filter searches with graylog_search_messages or graylog_search_aggregate. STEP-BY-STEP for scoped searching: 1. graylog_list_streams to find the stream ID for the relevant log category. 2. Pass the stream ID in the "streams" parameter of graylog_search_messages or graylog_search_aggregate. EXAMPLE: User asks "search for errors in the firewall logs" — first list streams to find the firewall stream ID, then search within that stream.

graylog_search_events: Search Graylog events and alerts. Events are triggered by event definitions when specific conditions are met (e.g., "more than 100 errors in 5 minutes"). Alerts are high-priority events that typically trigger notifications. Returns events with timestamp, message, priority, alert status, source, and associated fields. WHEN TO USE: "Show me recent alerts", "Were there any alerts today?", "What events fired in the last hour?", "Show me high-priority alerts", "Any critical events?", "What triggered the alert?", or when investigating incidents flagged by Graylog alerting. FILTER OPTIONS: alerts: "only" (only alerts), "exclude" (no alerts), "include" (both, default). priority: array of levels [1,2,3] where 1=High, 2=Normal, 3=Low. event_definitions: array of event definition IDs to filter by specific rules. EXAMPLES: All recent alerts: filter={"alerts":"only"}. High-priority alerts in last hour: filter={"alerts":"only","priority":[1]}, timerange={"type":"relative","range":3600}. All events (alerts + info): no filter needed (default includes both). STEP-BY-STEP for alert investigation: 1. graylog_search_events with filter={"alerts":"only"} to see what fired. 2. Read the event message to understand the condition. 3. graylog_search_messages with a relevant query and timerange to see the underlying logs that triggered the alert.

graylog_get_indices: Get information about Graylog index sets and their storage statistics. Returns index set name, description, document count, total size on disk, number of indices/shards, rotation strategy (time/size/message-count based), retention strategy (delete/close/archive), and health status (green/yellow/red). WHEN TO USE: "How much disk space are logs using?", "Show me index health", "How many log messages are stored?", "What is the retention policy?", "Are there any red indices?", "How long are logs kept?", "Show me Graylog storage stats", or when investigating performance issues related to disk usage. EXAMPLE: No parameters needed — returns all index sets. NOTE: Green = all shards healthy. Yellow = some replicas missing (usually OK for single-node). Red = data unavailable, needs attention.

Frequently Asked Questions about GraylogHow do I connect Graylog to Claude or ChatGPT?Create a free LearnToSpeak.ai account, add your Graylog credentials in the dashboard, and paste the generated OAuth URL into Claude.ai's custom connectors or ChatGPT's developer apps. The integration runs fully in the cloud — no desktop app, no CLI, no local install.Does it cost anything to connect Graylog?The Graylog integration is free during the LearnToSpeak.ai public beta. You only need a paid plan from Anthropic or OpenAI (Claude Pro/Max/Team or ChatGPT Plus/Pro/Team) since custom connectors require it on the AI provider side.Which AI assistants support the Graylog connector?Claude.ai (Pro, Max, Team, Enterprise) and ChatGPT (Plus, Pro, Team) both support the Graylog integration via the MCP (Model Context Protocol) standard. The same credentials work across both platforms — add the connector once, use it everywhere.How many Graylog tools does my AI get access to?Your AI gets 12 ready-to-use tools for Graylog, covering the most common read and write operations. Each tool is a discrete action the AI can call on demand — no multi-step prompting, no screen scraping, no workarounds.Is it safe to give an AI access to my Graylog account?Yes. Your Graylog credentials are encrypted at rest with AES-256-GCM and only decrypted in memory when the AI makes a request. LearnToSpeak.ai uses OAuth 2.1 with mandatory PKCE for the AI-to-platform connection, and you can revoke access instantly from the dashboard. We never store or log the actual tool responses returned to the AI.Why use LearnToSpeak.ai instead of running an MCP server locally?Cloud MCP servers work from any browser on any device — no Node.js install, no Docker, no local ports, no maintenance. Configure Graylog once in the dashboard and your AI connects from claude.ai or chat.openai.com directly. That's the entire value proposition: web AI assistants don't read your filesystem, they read our servers.What is the Graylog MCP server?The Graylog MCP server is a cloud-hosted integration that gives AI assistants direct access to Graylog through 12 tools via the Model Context Protocol (MCP) standard. It works with Claude, ChatGPT, Gemini, and any MCP-compatible AI — no local installation or Docker required.How do I connect Graylog to Claude via MCP?Sign up at LearnToSpeak.ai, add your Graylog credentials, and copy the generated MCP URL into Claude.ai's custom connectors (Settings → Developer → Custom Connectors). The cloud MCP server handles the connection — no CLI, no local server, no Docker.How do I connect Graylog to ChatGPT via MCP?Sign up at LearnToSpeak.ai, add your Graylog credentials, and copy the generated MCP URL into ChatGPT's developer apps (Settings → Apps → Advanced → Developer mode). Works with any ChatGPT Plus, Pro, or Team account.What can AI do with Graylog through MCP?Graylog offers 12 MCP tools covering Search logs, analyze events, monitor system health, and create dashboards in Graylog. Ask your AI to perform any of these actions in natural language — it calls the right tool automatically.What is MCP (Model Context Protocol)?MCP is an open standard that lets AI assistants like Claude, ChatGPT, and Gemini connect directly to external apps and services. LearnToSpeak.ai hosts cloud MCP servers so you don't need to install anything locally — your AI connects from any browser.Related MCP Servers

GitHub MCP Server — 44 tools

GitLab MCP Server — 90 tools

NetBox MCP Server — 179 tools

Cisco CPNR MCP Server — 36 tools

Grafana MCP Server — 50 tools

Browse all 34 MCP servers