What do the Graylog configs mean?

Created by Jeremy Lounder
Keywords:
graylog config charm-graylog
Last updated by:
Jeremy Lounder

The Graylog configs (and how we map them in the Charm) are pretty confusing, especially when you compare Graylog 2 and 3. I will walk through each of the configs available in Graylog, and then explain how they are set by the charm:

*Graylog 2*
rest_listen_uri - This is the setting Graylog uses to determine which network and port to LISTEN on for incoming REST API connections.
The charm does not allow this config to altered, and uses the default included with the SNAP: " http://0.0.0.0:9001/api/" - LISTEN on all networks, port 9001, with an HTTP path prefix of '/api/'.

web_listen_uri - Similar to rest_listen_uri, but used for the Web interface, and its secondary assets (JavaScript/CSS/Images etc). This allows for the Web interface to be connected to a different port than the REST API, or to be given an HTTP path prefix.
The charm's default value is: "http://0.0.0.0:9000/" - LISTEN on all networks, port 9000, with no HTTP prefix.

rest_transport_uri - This is the URI used by the Web Interface (or other external applications) to make connections to the Graylog REST APIs. This only needs to be set if you are running Graylog behind a load balancer or proxy. Otherwise, this will default to the first non-loopback IP address detected by Graylog, using the port and HTTP prefix from rest_listen_uri.
The charm will set this value to a default value of: "http://0.0.0.0:9001/api/"
*While a wildcard is not a valid setting for the IP address of this value in Graylog, the charm will see the wildcard and attempt to deduct the network interface that is used for connections to the default gateway and use the associated IP address.

web_endpoint_uri - Similar to the rest_transport_uri, this URI is used by the Web Interface to download secondary assets. It only needs to be set when you are running Graylog behind a load balancer or proxy. Otherwise, this will default to the first non-loopback IP address detected by Graylog, using the port and HTTP prefix from web_listen_uri
The charm does not set a default value for this config, and will let Graylog determine the correct IP on its own. If set with a wildcard IP (0.0.0.0), the charm will attempt to deduct the network interface that is used for connections to the default gateway and use the associated IP address.

*Graylog 3*
http_bind_address - This is a combination of rest_listen_uri and web_listen_uri. Graylog 3 does not allow the REST API and Web Interface to exist on different ports, nor does it allow the HTTP prefixes to be configured.
The charm does not allow this config to altered, and uses the default included with the SNAP: "0.0.0.0:9000" - LISTEN on all networks, port 9000.

http_publish_uri - This is an internal IP used for other Graylog nodes to connect back to this node. Graylog will attempt to use the value set in http_bind_address, if no config is provided. If http_bind_address is a wildcard address, Graylog will select the IP for the first non-loopback network adapter.
The charm does not currently allow this IP to be configured. Setting the config to a single value in the charm would cause all Graylog nodes in a cluster to publish the same IP address.

http_external_uri - This is the externally accessible address for Graylog. This is used by the Web Interface to access the REST API and to load secondary assets. It is only necessary if you are running Graylog behind a load balancer or proxy. If no config is provided, Graylog will use the value of http_publish_uri.
The charm does not set a default for this value. This value can be set with the 'web_endpoint_uri' charm config.