Graylog 2.2.3 integration (range problem)

Help
1

Hi,

I have install LibreNMS and it’s working perfectly. We’re currently trying to integrate it with our current Graylog environment to have a centralice place were to look logs, configs, etc (already oxidized configured).

Just for documentation purposes, with the new graylog version the base url path has to be specified as follows:

$config[‘graylog’][‘base_uri’] = ‘/search/universal/relative’;

Otherwise you’ll be stuck with a 404 error. Once I discovered that now that it seems like Graylog is replying with a 200 message.

After fighting for a day or so and finally make it work I can see is super slow and I think I know why. The variable range is not set so graylog does the search over the whole database and then just display the number of messages you specified (by default 25). This is really inefficient and for a big DB like ours it’s super slow. I’ve been checking the code for the graylog integration and I can see the variable should be received from a POST, but I cannot see any option to specify it. What am I missing?

/opt/librenms/html/includes/common/graylog.inc.php: range: “’ . (isset($_POST[‘range’]) ? mres($_POST[‘range’]) : ‘’) . '”

/opt/librenms/html/includes/table/graylog.inc.php: $graylog_url = $config[‘graylog’][‘server’] . ‘:’ . $config[‘graylog’][‘port’] . $graylog_base . ‘?query=’ . urlencode($query) . ‘&range=’. $filter_range . $extra_query;

2

We’ll look into adding into the docs.

3

range is supposed to be a time range.

Please try this patch: https://p.libren.ms/view/raw/21765cd6

If it works for you let us know.

4

Hi,

Thanks for the quick reply. It worked fine so now in the overview --> Graylog menu there is a form with the time and by default is 5 min. That’s really useful! Thanks. Still there is the same problem when you add the widget on the dashboard or try to access the specific device logs. For the widget I assume a default of 5 - 30 min will be great and maybe an option to change it. For the devices something similar to this patch will be great.

5

Just to let you know, the new patch as I said worked fine but by default until you click on the filter button it doesn’t send the range that means the first time you click on the Graylog menu (on the overview) it sends a request that blocks the server response for the time it takes to retrieve ALL the messages in the DB.

After this first request, the next ones are faster (because there’s sending the range command). I don’t know if it will be easier maybe to define a variable that sets a default value for range (to avoid this first request) and then the possibility to override that value on the gui with the filter button.

Something like $config[‘graylog’][‘default_range’] = ‘300’; maybe?

Thanks

6

Create an issue on github with this info.