Graylog MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GRAYLOG_CONFIG_PATH | No | Override the default config path (~/.graylog-mcp/config.json) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_connectionsA | List all available Graylog connections configured in ~/.graylog-mcp/config.json |
| use_connectionA | Connect to a specific Graylog instance by name. Must be called before fetching messages. |
| fetch_graylog_messagesB | Fetch messages from the active Graylog connection. Use 'use_connection' first to select a connection. |
| get_surrounding_messagesA | Get messages surrounding a specific message. Provide messageId (preferred) or messageTimestamp to identify the target message. |
| list_streamsA | List all available Graylog streams in the active connection. |
| list_field_valuesA | List distinct values of a field with message counts. Useful for discovering available sources, environments, logger names, etc. Results are sorted by count descending. |
| get_log_histogramC | Get a time-based histogram of log messages. Shows message counts over time intervals. |
| get_field_aggregationC | Aggregate log messages by field values with statistics. Get counts, sums, averages, etc. for field values. |
| get_field_time_aggregationC | Two-dimensional aggregation: field values over time. Shows how field values change over time intervals. |
| debug_histogram_queryA | Debug helper to test if the histogram query finds any messages at all. Use this if histogram returns empty buckets. |
| save_searchB | Save a named search query for later reuse. Saves query parameters so you don't have to re-type complex searches. |
| list_saved_searchesB | List all saved searches. |
| get_saved_searchB | Load and execute a saved search by name. Optional overrides can be provided to adjust the search at execution time. |
| delete_saved_searchB | Delete a saved search by name. |
| search_eventsA | Search Graylog events and alerts. Use 'use_connection' first to select a connection. |
| get_event_definitionsB | Get Graylog event definitions. Use 'use_connection' first to select a connection. |
| get_event_notificationsA | Get Graylog event notifications. Use 'use_connection' first to select a connection. |
| cluster_log_messagesA | Cluster similar log messages into Drain3-style templates. Fetches messages with the same args as fetch_graylog_messages, then groups them by structural similarity. Templates are persisted per connection and reused across calls. |
| list_log_templatesB | List learned log templates for the active connection. |
| delete_log_templateB | Delete a learned log template by ID. |
| rename_log_templateB | Set or update a human-readable label for a template. |
| export_log_templatesA | Export all learned templates for the active connection as JSON. |
| import_log_templatesB | Import templates into the active connection's library. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 23 tools
Each tool targets a distinct resource or action, such as connections, streams, saved searches, event definitions, or log templates. Overlapping analysis tools like get_log_histogram and get_field_time_aggregation are clearly differentiated by their descriptions.
All tool names follow a consistent verb_noun pattern in snake_case, with verbs like list, get, fetch, save, delete, and rename. This makes the set predictable and easy to navigate.
23 tools is a substantial set, but it covers a broad range of Graylog functionality including connections, searches, events, analysis, and template management. The count is slightly heavy but each tool contributes to a cohesive workflow.
The tool surface provides strong coverage for log searching, analysis, saved searches, and log template CRUD operations. While event and stream management are read-only (no create/update/delete), the core log analysis lifecycle is well represented.