From graylog-log-search
Use when Graylog MCP tools return errors (connection refused, 401, target not found, empty results when results are expected). Diagnoses connectivity, auth, and configuration. Triggers on graylog tool failures, "connection refused", "401", "target not found", "graylog isn't returning anything".
How this skill is triggered — by the user, by Claude, or both
Slash command
/graylog-log-search:troubleshootingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill when Graylog MCP tool calls fail or return nothing unexpectedly.
Use this skill when Graylog MCP tool calls fail or return nothing unexpectedly.
get_system_infoIf any other tool fails, call get_system_info first. It tells you whether the server is reachable and the credentials are valid. If it returns successfully, the connection is fine and the issue is in the query.
If get_system_info itself fails, work through Steps 2–4 below.
BASE_URL checksThe BASE_URL env var must:
https://graylog.example.com (or http:// for local)./api or a trailing slash. The server adds the API path.Verify reachability:
curl -fsS -o /dev/null -w "%{http_code}\n" "$BASE_URL/api/system" -u "$API_TOKEN:token" && echo OK
If curl returns 200, the URL and token both work; the MCP server itself is misconfigured. If curl fails, it is a network / auth problem.
API_TOKEN checkstoken as the password (Graylog convention). Confirm the MCP server's HTTP basic auth header reflects this.curl returns 401 with a known-good URL, regenerate the token.| Status | Meaning | Fix |
|---|---|---|
| 401 | Token invalid / expired | Regenerate token, update API_TOKEN. |
| 403 | Token valid, lacks scope | Ask the Graylog admin to grant read access to the streams you need. |
| 404 on stream filter | Stream ID doesn't exist or token can't see it | Call list_streams to confirm valid IDs visible to this token. |
| 5xx | Graylog server-side issue | Not the MCP server's fault. Check Graylog itself. |
If a search returns zero hits but you know logs exist:
from/to as local-time ISO strings without a UTC offset, you may be querying the wrong window. Always use Z-suffixed UTC.field=value won't work; use field:value. AND/OR must be uppercase.service:foo ≠ Service:foo.streamId the token can't read, you get an empty (not an error) response.list_streams returns emptyThe token has no stream-read permissions. Ask the admin to grant read access; the MCP server itself is fine.
If steps 1–5 all check out and the tool still fails, the problem is on the Graylog server side (cluster issue, indexer down, retention purge). Surface what you've verified and ask the user to check with their Graylog operator or check the Graylog /api/system/cluster/health endpoint directly.
npx claudepluginhub pranavj17/mcp-server-graylog --plugin graylog-log-searchProvides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.