https://github.com/graylog2/graylog-schema
Repository for Graylog Schema files and Documentation
https://github.com/graylog2/graylog-schema
documentation graylog logging schema
Last synced: about 1 year ago
JSON representation
Repository for Graylog Schema files and Documentation
- Host: GitHub
- URL: https://github.com/graylog2/graylog-schema
- Owner: Graylog2
- License: other
- Created: 2020-09-02T17:14:06.000Z (almost 6 years ago)
- Default Branch: 1.0
- Last Pushed: 2024-05-08T18:38:40.000Z (about 2 years ago)
- Last Synced: 2024-05-08T20:32:14.324Z (about 2 years ago)
- Topics: documentation, graylog, logging, schema
- Language: Python
- Homepage: https://schema.graylog.org
- Size: 176 KB
- Stars: 2
- Watchers: 13
- Forks: 4
- Open Issues: 28
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# Graylog Schema
Welcome to the Graylog Information Model (GIM). The Schema is broken down into sections, like "File" or "Destination" with all meta data fields below that link.
[Graylog Illuminate](http://www.graylog.com/ "Graylog") will utilize this schema for all the content it will be creating. This guide will the be official reference, and should be used if you are creating your own content, and want it to match with our content we create.
If you take any log source, and put the user name into a field called `user_name`, then any dashboard or alert created with Illuminate will work as well.
# Graylog Template
During processing of the logs, data from the logs are inserted into Elasticsearch as "keywords", meaning they are not modified in any way, and stored as-is. This means the follow data points are unique:
`Administrator` or `administrator`
If you are doing a search in the Graylog UI, you would have to search for both of the terms, or know exactly which one to search for. Fields like `user_name` make sense to have the ability to search without worrying about the case of the word.
In order to ensure these options are accounted for, a custom analyzer has been included in the Graylog Schema template, called "loweronly". Fields normalized with "loweronly" will be converted to lowercase before the data is indexed, and search query strings for these fields will be converted to lowercase as well when ran. Pages in the schema, will list these fields as `keyword/loweronly` for reference.
# Graylog Help
If you see any suggestions, or feature requests for this project, please submit a issue [here](https://github.com/Graylog2/graylog-schema/issues).
Happy Logging!