Querying aggregated Graylog data with Python

Graylog Central (peer support)
,
1

I have setup extremely useful dashboards in Graylog that aggregate network traffic to better understand nefarious patterns and take corrective actions. However, I’m interested in automating this process for obvious reasons. Is there a way to push or pull these data to python?

For example: I have a dashboard data-table that shows blocked connections by ip address per minute. I’d like these data within python for further analysis and actions (through scripts running on the graylog server itself).

If this isn’t possible through the Graylog API, is it possible to query Elasticsearch directly?

I apologize if this has been answered or is in the wrong location, but I haven’t been able to find a satisfactory answer (most posts appear more interested in getting data into Graylog). As a newbie, it appears that Graylog is very flexible and powerful and could easily provide this functionality. Am I barking up the wrong tree? Thanks!

2

Hello && welcome @edwardl

First, I know very little about executing this through Python. Maybe some one lese here has thou.

Graylog does have a API Browser located in System/Node. There is a GET,POST,PULL & DELETE Options. Most have used cURL to execute what you want to do.

3

Thanks so much for your response, @gsmith! I’m very much a newb, so I appreciate it.

I did discover the API browser and after some trail and error have been able to get JSON responses containing the full messages that could be parsed and aggregated into the datasets of concern (next step tokens). But it seems like it would be more efficient on a couple fronts to have the ability to directly request the aggregated tables within dashboards. I’ll keep poking about, but would appreciate any breadcrumbs the community could provide.

4

Hello @edwardl

Sound good,

You will find most of your setting within MongoDb. Depending on what version is being used, I noticed MongoDb metadata for Graylog dashboards are now under Views.

> use graylog
switched to db graylog
> show collections
sidecar_configuration_variables
sidecar_configurations
sidecars
streamrules
streams
system.profile
system_messages
team_sync_backend_configs
teams
traffic
users
view_sharings
views
>db.views.find().pretty();
  },
        "owner" : "greg.smith",
        "created_at" : ISODate("2018-01-06T02:41:45.797Z")
}
{
        "_id" : ObjectId("62e36711ce8c7a2e9c0c4611"),
        "type" : "DASHBOARD",
        "title" : "Sources",
        "summary" : "Sources",
        "description" : "Sources",
        "search_id" : "62e1f883f74e2d1cce726e85",
        "properties" : [ ],
        "requires" : {

        },
        "state" : {
                "a1647eb6-a064-4fe6-b459-1e4267d3f659" : {
                        "titles" : {
                                "tab" : {
                                        "title" : "Sources Overview"
                                },
                                "widget" : {
                                        "4a02a354-84b8-4b5b-a7c7-ceb8c5976a3a" : "Messages for source:labveeam.enseva\\-labs.net",
                                        "6c127c5d-be75-4157-b43f-ac0194ac0586" : "Selected sources",

I’m curious on what you find.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.