I was wondering if I can process Graylog events with Apache Storm in realtime, e.g. anything that matches a given search expression.
For this I assume it would be necessary to have a spout that reads the data from Graylog and does the processing in Storm or some kind of push API that can send the data from Graylog to Storm.
Graylog doesn’t support this out of the box, but I’m pretty sure you can write a Storm Sprout accessing the Graylog REST API and polling it for the required information, or write an output plugin sending messages from a stream to Apache Storm somehow.
See http://docs.graylog.org/en/2.2/pages/plugins.html for details on writing plugins for Graylog.