Graylog Log Search

Install

npm install -g mcp-server-graylog@1.0.3

Configure

Add to your OpenClaw or Claude Desktop MCP configuration:

{
  "mcpServers": {
    "graylog": {
      "command": "npx",
      "args": ["-y", "mcp-server-graylog@1.0.3"],
      "env": {
        "BASE_URL": "https://your-graylog-instance.example.com",
        "API_TOKEN": "your_graylog_api_token"
      }
    }
  }
}

To get your API token: Graylog Web UI > System > Users > Edit your user > Tokens > Create Token.

Verify

echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0.0"}}}' | BASE_URL=https://your-graylog.example.com API_TOKEN=your_token npx mcp-server-graylog@1.0.3

You should see a JSON response with protocolVersion and capabilities.

| Error | Solution | |-------|----------| | "Missing environment variables" | Set BASE_URL and API_TOKEN in your MCP config | | "Authentication failed" | Verify your API token is valid in Graylog UI | | "Cannot reach Graylog" | Check BASE_URL and network/VPN connectivity | | "Invalid query" | Check Elasticsearch query syntax | | "Endpoint not found" | Verify BASE_URL includes the correct Graylog URL (no trailing /api) |