Server Conf

The file server.conf is the LeonaLog default configuration file.

TOC

• General

• Web & REST API

• Elasticsearch

• Rotation

• MongoDB

• Email

• HTTP

• Processing Status

• Script Alert Notification

• Others

General

• is_leader = true

  • If you are running more than one instance of LeonaLog server you have to select only one leona-server node as the leader.

  • This node will perform periodical and maintenance actions that replica nodes won’t.

  • Replica nodes will accept messages just the same as leader nodes.

  • Nodes will fall back to replica mode if there already is a leader in the cluster.

• node_id_file = /etc/graylog/server/<node-id>

  • The auto-generated node ID will be stored in this file and read after restarts. It is a good idea to use an absolute file path here if you are starting LeonaLog server from init scripts or similar.

• password_secret = <secret>

  • You MUST set a secret that is used for password encryption and salting. The server will refuse to start if it’s not set. Use at least 64 characters. If you run multiple leonalog-server nodes, make sure you use the same password_secret for all of them!

• root_username = admin

  • The default root user is named admin.

• root_password_sha2 = <SHA2>

  • A SHA2 hash of a password you will use for your initial login. Set this to a SHA2 hash generated with echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1 and you will be able to log in to the web interface with username admin and password your-password.

• root_email = ""

  • The email address of the root user. The default is empty.

• root_timezone = UTC

  • The time zone setting of the root user. See this list of valid time zones. The default is UTC.

• bin_dir = bin

  • This directory contains binaries that are used by the LeonaLog server. (relative or absolute)

• data_dir = data

  • This directory is used to store LeonaLog server state. (relative or absolute)

• plugin_dir = plugin

  • Set the plugin directory here (relative or absolute)

Web & REST API

• http_bind_address = 127.0.0.1:9000

  • The network interface used by the LeonaLog HTTP interface.

  • This network interface must be accessible by all LeonaLog nodes in the cluster and by all clients using the LeonaLog web interface.

  • If the port is omitted, LeonaLog will use port 9000 by default.

• http_publish_uri = https://$http_bind_address/

  • The HTTP URI of this LeonaLog node which is used to communicate with the other LeonaLog nodes in the cluster and by all clients using the LeonaLog web interface.

  • The URI will be published in the cluster discovery APIs, so that other LeonaLog nodes will be able to find and connect to this LeonaLog node.

  • This configuration setting has to be used if this LeonaLog node is available on another network interface than $http_bind_address, for example if the machine has multiple network interfaces or is behind a NAT gateway.

  • This configuration setting must not be configured to a wildcard address!

  • If http_bind_addresscontains a wildcard IPv4 address (0.0.0.0), http_publish_uri will be filled with the first non-loopback IPv4 address of this machine instead.

• http_external_uri = $http_publish_uri

  • The public URI of LeonaLog which will be used by the LeonaLog web interface to communicate with the LeonaLog REST API.

  • The external LeonaLog URI usually has to be specified, if LeonaLog is running behind a reverse proxy or load-balancer and it will be used to generate URLs addressing entities in the LeonaLog REST API (see $http_bind_address).

  • When using LeonaLog Collector, this URI will be used to receive heartbeat messages and must be accessible for all collectors.

  • This setting can be overridden on a per-request basis with the “X-Graylog-Server-URL” HTTP request header.

• http_enable_cors = true

  • Enable CORS headers for HTTP interface.

  • This is necessary for JS-clients accessing the server directly.

  • If these are disabled, modern browsers will not be able to retrieve resources from the server.

• http_enable_gzip = true

  • This compresses API responses and therefore helps to reduce overall round trip times.

• http_max_header_size = 8192

  • The maximum size of the HTTP request headers in bytes.

• http_thread_pool_size = 16

  • The size of the thread pool used exclusively for serving the HTTP interface.

• http_enable_tls = false

  • This secures the communication with the HTTP interface with TLS to prevent request forgery and eavesdropping.

• http_tls_cert_file = /path/to/graylog.crt

  • The X.509 certificate chain file in PEM format to use for securing the HTTP interface.

• http_tls_key_file = /path/to/graylog.key

  • The PKCS#8 private key file in PEM format to use for securing the HTTP interface.

• http_tls_key_password = secret

  • The password to unlock the private key used for securing the HTTP interface. (if key is encrypted)

• trusted_proxies = 127.0.0.1/32, 0:0:0:0:0:0:0:1/128

  • Comma-separated list of trusted proxies that are allowed to set the client address with X-Forwarded-For header. Maybe subnets or hosts.

Elasticsearch

• elasticsearch_hosts = https://node1:9200,https://user:password@node2:19200

  • List of Elasticsearch hosts LeonaLog should connect to.

  • Need to be specified as a comma-separated list of valid URIs for the HTTP ports of your Elasticsearch nodes.

  • If one or more of your Elasticsearch hosts require authentication, include the credentials in each node URI that requires authentication.

  • Default: https://127.0.0.1:9200

• elasticsearch_connect_timeout = 10s

  • Maximum amount of time to wait for successful connection to Elasticsearch HTTP port.

  • Default: 10 seconds

• elasticsearch_socket_timeout = 60s

  • Maximum amount of time to wait for reading back a response from an Elasticsearch server.

  • Default: 60 seconds

• elasticsearch_idle_timeout = -1s

  • Maximum idle time for an Elasticsearch connection. If this is exceeded, this connection will be tore down.

  • Default: infinity

• elasticsearch_max_total_connections = 200

  • Maximum number of total connections to Elasticsearch.

  • Default: 200

• elasticsearch_max_total_connections_per_route = 20

  • Maximum number of total connections per Elasticsearch route (normally this means per Elasticsearch server).

  • Default: 20

• elasticsearch_max_retries = 2

  • Maximum number of times LeonaLog will retry failed requests to Elasticsearch.

  • Default: 2

• elasticsearch_discovery_enabled = false

  • Enable automatic Elasticsearch node discovery through Nodes Info, see Elasticsearch Reference » Cluster APIs » Nodes Info.

  • Default: false

• elasticsearch_discovery_filter = rack:42

  • Filter for including/excluding Elasticsearch nodes in discovery according to their custom attributes, see Elastic Search Reference » Cluster APIs » Node Specification .

  • Default: empty

• elasticsearch_discovery_frequency = 30s

  • Frequency of the Elasticsearch node discovery.

  • Default: 30 seconds

• elasticsearch_discovery_default_scheme = http

  • Set the default scheme when connecting to Elasticsearch discovered nodes. (available options: HTTP, HTTPs)

  • Default: HTTP

• elasticsearch_compression_enabled = false

  • Enable payload compression for Elasticsearch requests.

  • Default: false

• elasticsearch_use_expect_continue = true

  • Enable use of "Expect: 100-continue" Header for Elasticsearch index requests. If this is disabled, LeonaLog cannot properly handle HTTP 413 Request Entity Too Large errors.

  • Default: true

Rotation

• rotation_strategy = count !

  • Graylog will use multiple indices to store documents in. You can configured the strategy it uses to determine when to rotate the currently active write index.

  • It supports multiple rotation strategies:- count of messages per index, use elasticsearch_max_docs_per_index - size per index, use elasticsearch_max_size_per_index

  • Valid values are count, size, and time; default is count.

• elasticsearch_max_docs_per_index = 20000000 !

  • (Approximate) maximum number of documents in an Elasticsearch index before a new index is being created; also see no_retention and elasticsearch_max_number_of_indices.

  • Configure this if you used rotation_strategy = count above.

• elasticsearch_max_size_per_index = 1073741824 !

  • (Approximate) maximum size in bytes per Elasticsearch index on disk before a new index is being created; also see no_retention and elasticsearch_max_number_of_indices. Default is 1GB.

  • Configure this if you used rotation_strategy = size above.

• elasticsearch_max_time_per_index = 1d !

  • (Approximate) maximum time before a new Elasticsearch index is being created; also see no_retention and elasticsearch_max_number_of_indices. Default is 1 day.

  • Configure this if you used rotation_strategy = time above.

  • Please note that this rotation period does not look at the time specified in the received messages, but is using the real clock value to decide when to rotate the index!

  • Specify the time using a duration and a suffix indicating which unit you want:

    • 1w = 1 week

    • 1d = 1 day

    • 12h = 12 hours

  • Permitted suffixes are: d for day, h for hour, m for minute, s for second.

• elasticsearch_max_number_of_indices = 20 !

  • How many indices do you want to keep?

• retention_strategy = delete !

  • Decide what happens with the oldest indices when the maximum number of indices is reached.

  • The following strategies are available:

    • delete - Deletes the index completely (Default)

    • close - Closes the index and hides it from the system. Can be re-opened later.

• outputbuffer_processor_keep_alive_time = 5000

• outputbuffer_processor_threads_core_pool_size = 3

• outputbuffer_processor_threads_max_pool_size = 30

• udp_recvbuffer_sizes = 1048576

  • UDP receive buffer size for all message inputs (e. g. SyslogUDPInput).

• processor_wait_strategy = blocking

  • Wait strategy describing how buffer processors wait on a cursor sequence. (default: sleeping)

  • Possible types:

    • yielding - Compromise between performance and CPU usage.

    • sleeping - Compromise between performance and CPU usage. Latency spikes can occur after quiet periods.

    • blocking - High throughput, low latency, higher CPU usage.

    • busy_spinning - Avoids syscalls, which could introduce latency jitter. Best when threads can be bound to specific CPU cores.

• ring_size = 65536

  • Size of internal ring buffers. Raise this if raising outputbuffer_processors does not help anymore.

  • For optimum performance your LogMessage objects in the ring buffer should fit in your CPU L3 cache.

  • Must be a power of 2. (512, 1024, 2048, …)

• inputbuffer_ring_size = 65536

• inputbuffer_processors = 2

• inputbuffer_wait_strategy = blocking

• message_journal_enabled = true

  • Enable the disk-based message journal.

• message_journal_dir = data/journal

  • The directory which will be used to store the message journal. The directory must me exclusively used by LeonaLog and must not contain any other files than the ones created by LeonaLog itself.

• message_journal_max_age = 12h

• message_journal_max_size = 5gb

  • Journal hold messages before they could be written to Elasticsearch.

  • For a maximum of 12 hours or 5 GB whichever happens first.

  • During normal operation the journal will be smaller.

• message_journal_flush_age = 1m

  • This setting allows specifying a time interval at which we will force an fsync of data written to the log. For example if this was set to 1000 we would fsync after 1000 ms had passed.

• message_journal_flush_interval = 1000000

  • This setting allows specifying an interval at which we will force an fsync of data written to the log. For example if this was set to 1 we would fsync after every message; if it were 5 we would fsync after every five messages.

• message_journal_segment_age = 1h

  • This configuration controls the period of time after which LeonaLog will force the log to roll even if the segment file isn’t full to ensure that retention can delete or compact old data.

• message_journal_segment_size = 100mb

• async_eventbus_processors = 2

  • Number of threads used exclusively for dispatching internal events. Default is 2.

• lb_recognition_period_seconds = 3

  • How many seconds to wait between marking node as DEAD for possible load balancers and starting the actual shutdown process. Set to 0 if you have no status checking load balancers in front.

• lb_throttle_threshold_percentage = 95

  • Journal usage percentage that triggers requesting throttling for this server node from load balancers. The feature is disabled if not set.

• stream_processing_timeout = 2000

• stream_processing_max_faults = 3

  • Every message is matched against the configured streams and it can happen that a stream contains rules which take an unusual amount of time to run, for example if its using regular expressions that perform excessive backtracking.

  • This will impact the processing of the entire server. To keep such misbehaving stream rules from impacting other streams, LeonaLog limits the execution time for each stream.

  • The default values are noted below, the timeout is in milliseconds.

  • If the stream matching for one stream took longer than the timeout value, and this happened more than “max_faults” times that stream is disabled and a notification is shown in the web interface.

MongoDB

• mongodb_uri = mongodb://...

  • MongoDB connection string. Enter your MongoDB connection and authentication information here.

  • See https://docs.mongodb.com/manual/reference/connection-string/ for details.

  • Take notice that + signs in the username or password need to be replaced by %2B.

  • Examples:

    • Simple: mongodb://localhost/graylog

    • Authenticate against the MongoDB server: mongodb_uri = mongodb://grayloguser:secret@localhost:27017/graylog

    • Use a replica set instead of a single host: mongodb://grayloguser:secret@localhost:27017,localhost:27018,localhost:27019/graylog?replicaSet=rs01

    • DNS Seedlist is set as mongodb+srv://server.example.org/graylog.

• mongodb_max_connections = 1000

  • Increase this value according to the maximum connections your MongoDB server can handle from a single client if you encounter MongoDB connection problems.

• mongodb_threads_allowed_to_block_multiplier = 5

  • Number of threads allowed to be blocked by MongoDB connections multiplier. Default: 5

  • If mongodb_max_connections is 100, and mongodb_threads_allowed_to_block_multiplier is 5, then 500 threads can block. More than that and an exception will be thrown.

Email

• transport_email_enabled = false

• transport_email_hostname = mail.example.com

• transport_email_port = 587

• transport_email_use_auth = true

• transport_email_use_tls = true

  • Enable SMTP with STARTTLS for encrypted connections.

• transport_email_use_ssl = false

  • Enable SMTP over SSL (SMTPS) for encrypted connections.

• transport_email_auth_username = [e-mail]

• transport_email_auth_password = secret

• transport_email_subject_prefix = [graylog]

• transport_email_from_email = [e-mail]

• transport_email_web_interface_url = https://graylog.example.com

  • Specify this to include links to the stream in your stream alert mails.

  • This should define the fully qualified base RUL to your web interface exactly the same way as it is accessed by your users.

HTTP

• http_connect_timeout = 5s

  • The default connect timeout for outgoing HTTP connections.

  • Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds).

  • Default: 5s

• http_read_timeout = 10s

  • The default read timeout for outgoing HTTP connections.

  • Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds).

  • Default: 10s

• http_write_timeout = 10s

  • The default write timeout for outgoing HTTP connections.

  • Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds).

  • Default: 10s

• http_proxy_uri =

  • HTTP proxy for outgoing HTTP connections

Processing Status

• processing_status_persist_interval = 1s

  • The server is writing processing status information to the database on a regular basis. This setting controls how often the data is written to the database.

  • Values must be a positive duration and cannot be less than one second.

  • Default: 1s (one second)

• processing_status_update_threshold = 1m

  • Configures the threshold for detecting outdated processing status records. Any records that haven’t been updated in the configured threshold will be ignored.

  • Values must be a positive duration and cannot be less than one second.

  • Default: 1m (one minute)

• processing_status_journal_write_rate_threshold= 1

  • Configures the journal write rate threshold for selecting processing status records. Any records that have a lower one minute rate than the configured value might be ignored. (dependent on number of messages in the journal)

  • Values must be a positive duration.

  • Default: 1

Script Alert Notification

• integrations_web_interface_uri = https://graylog.example.com

  • Specify this to include a search page link (that displays relevant alert messages) in the script arguments or standard in JSON.

  • This should define the fully qualified base URL to your web interface exactly the same way as it is accessed by your users.

  • Default: none

• integrations_scripts_dir = /usr/share/graylog-server/scripts

  • An absolute or relative path where scripts are permitted to be executed.

  • If specified, this overrides the default location.

Others

• gc_warning_threshold = 1s

  • The threshold of the garbage collection runs. If GC runs take longer than this threshold, a system notification will be generated to warn the administrator about possible problems with the system. The default is 1 second.

• ldap_connection_timeout = 2000

  • Connection timeout for a configured LDAP server (e. g. ActiveDirectory) in milliseconds.

• disable_native_system_stats_collector = false

  • Disable the use of OSHI for collecting system stats.

• dashboard_widget_default_cache_time = 10s

  • The default cache time for dashboard widgets. (Default: 10 seconds, minimum: 1 second)

• proxied_requests_thread_pool_size = 32

  • For some cluster-related REST requests, the node must query all other nodes in the cluster. This is the maximum number of threads available for this. Increase it, if /cluster/* requests take long to complete.

  • Should be http_thread_pool_size * average_cluster_size if you have a high number of concurrent users.

• default_events_index_prefix = gl-events

  • The default index prefix for leona events.

• default_system_events_index_prefix = gl-system-events

  • The default index prefix for leona system events.

• enabled_tls_protocols = TLSv1.2,TLSv1.3

  • Configure system-wide enabled TLS protocols. Only configure this if you need to support legacy systems. We will maintain a secure default. (Currently TLS 1.2 and TLS 1.3. Note: The web interface cannot support TLS 1.3 with JDK 8)

• content_packs_loader_enabled = false

  • Automatically load content packs in "content_packs_dir" on the first start of LeonaLog.

• content_packs_dir = data/contentpacks

  • The directory which contains content packs which should be loaded on the first start of LeonaLog.

• content_packs_auto_install

  • A comma-separated list of content packs (files in "content_packs_dir") which should be applied on the first start of Leona.

  • Default: none