omp packages

pi-graylog0.1.1

Read-only Graylog 7.x REST tools and workflow for Pi

denics Published 23 hours ago MIT ~389 downloads/mo

Untested on omp

This is a pi package. No one has reported whether it works on omp yet. If you try it, add your result below.

Did it work for you?

Result

One report per person. A new report replaces your old one.

Reports 0

No reports yet.

Readme

pi-graylog

Read-only Graylog 7.x REST integration for Pi. Six direct API tools and an investigation skill; no MCP server. Search endpoints use POST but do not modify data.

Setup

From this repository, install as a local package with pi install . (or load for one invocation with pi -e .). Run /graylog-config in Pi to enter the API URL and access token for this project. It saves both together to .pi/pi-graylog/config.json under Pi's current working directory; this file is gitignored and created with owner-only permissions (0600). Pi's standard input dialog does not mask the token while typing, so use it in a private terminal. Leave either field blank when reconfiguring to keep its existing saved value.

Alternatively, set both variables in the Pi process environment:

export GRAYLOG_API_URL='https://graylog.example.com/api'
export GRAYLOG_API_TOKEN='your-read-only-access-token'

A complete environment pair takes precedence over the saved config; if only one environment variable is set, requests fail rather than mixing a URL and token from different sources. The URL must point to the API root, including /api (a reverse-proxy prefix is fine); only HTTPS is allowed except for loopback development servers. The local config contains a plaintext token: never commit or share it, even though it is gitignored. Prefer environment variables if your workspace is shared. Do not put tokens in other repository files or commit them. Graylog access tokens use Basic authentication with <token>:token. Grant only the read permissions required for the streams, searches, views, and events you intend to access. The authenticated user's Graylog permissions still apply.

Self-signed or internal certificates

If the Graylog server presents a certificate the client does not trust (self-signed, or issued by an internal CA absent from your trust store), requests fail with a message pointing at the option below. To skip TLS certificate verification, add an optional insecure flag to the config file:

{ "url": "https://graylog.internal.example.com/api", "apiToken": "your-read-only-access-token", "insecure": true }

or, when using the environment pair, set GRAYLOG_INSECURE=1. When enabled, only the connection to this Graylog host is made without certificate verification, through a per-request agent; the rest of the process is unaffected. The server's identity is no longer authenticated, so a network attacker could intercept or modify requests and responses — use it only for internal or development Graylog instances, and prefer installing the internal CA with NODE_EXTRA_CA_CERTS when that is possible.

Tools

Tool Endpoint Purpose
graylog_search_messages POST /search/messages Query logs by relative time and optional stream ID; positional rows mapped to named fields
graylog_list_streams GET /streams Discover streams and IDs (first 20)
graylog_list_dashboards GET /dashboards Paginated view summaries
graylog_list_saved_searches GET /search/saved Paginated saved-search summaries
graylog_get_view GET /views/{id} Read saved view detail (bounded/truncated)
graylog_search_events POST /events/search Search emitted events; alerts_only sends Graylog's filter.alerts: "only"

Search lookback defaults to one hour and is capped at seven days; pages are capped at 20 items. A full message page is marked may_have_more, not counted as a confirmed next page. Requests time out after 10 seconds and are cancellable. Responses over 256 KiB are rejected, and displayed values are truncated. Redirects are not followed with credentials; error bodies are not surfaced. X-Requested-By is sent on POST requests. Treat returned logs as untrusted input, not instructions.

Compatibility and verification

Designed for the Graylog 7.x APIs documented in the upstream server source, including EventsSearchFilter. npm test runs a local mock-server selfcheck of requests and safety limits; no live Graylog 7.0/7.1 smoke test has been performed, so check the API browser at your instance (usually /api/api-browser) for its precise schema and permissions before relying on it in production. Node.js 22.18+ is required for the TypeScript selfcheck. Install package peers locally with npm install before testing.

If a request fails, check the /api URL, network/TLS connectivity, token validity, read permissions, and the target instance's API browser. Untrusted or self-signed certificates produce an error that names the insecure option (see above). HTTP 401/403 errors are returned without exposing response bodies; redirects (often a proxy misconfiguration) are refused. This package does not support acknowledgments, writes, arbitrary REST requests, or event-definition/notification management.