Graylog: Using with Node.js

How to send logs from Node.js to Graylog

👋 Welcome to Stackhero documentation

Stackhero offers a fully managed Graylog cloud solution designed for speed and simplicity. You can:

• Count on an unlimited, dedicated SMTP email server included with your service.
• Apply updates easily with a single click, with no manual intervention required.
• Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), providing your team with secure, direct access.
• Benefit from strong performance and security on a private, dedicated infrastructure with no shared resources or noisy neighbours.

Focus on your data, not your tools: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.

Sending Node.js logs to Graylog with the graylog2 package (recommended)

Sending logs from Node.js to Graylog is very straightforward. In this example, you will see how to use the graylog2 package to make this process smooth.

To get started, install the package by running the following command:

npm install graylog2

Here’s how you can use it to log messages:

const graylog2 = require('graylog2');
const crypto = require('crypto');

const logger = new graylog2.graylog({
  servers: [{ host: '<XXXXXX>.stackhero-network.com', port: 12201 }] // Be sure to replace "host" with your Graylog domain
});

// Send a simple message to Graylog
logger.log('Simple message example');

// Attach data to a message
logger.log(
  'Password recovery email', // Message
  // A JSON object with additional details
  {
    subject: 'Password recovery',
    language: 'en_US',
    domain: 'gmail.com'
  }
);

// Advanced example
const ip = '1.2.3.4';
const ipHash = crypto.createHash('md5').update(ip).digest('hex');

const userId = '1234';
const userIdHash = crypto.createHash('md5').update(userId).digest('hex');

logger.log(
  'API request', // Message
  // A JSON object with more details
  {
    route: '/v1/messages/1234/',
    method: 'POST',

    responseTime: 12, // ms
    responseCode: 200,

    ipHash,
    userIdHash
  }
);

// Log uncaught exceptions in Node.js
process.on(
  'uncaughtException',
  err => {
    logger.log(
      err,
      { type: 'uncaughtException' }
    );
  }
);

For more examples, you can check out this GitHub repository.

warning Don’t forget to configure your Graylog input (see details below).

Using the Winston GELF package to send Node.js logs to Graylog

warning It is best to use the graylog2 package unless Winston is already part of your project. In that case, you can switch to winston-gelf.

To install the Winston GELF package, run:

npm install winston-gelf

If Winston is not already in your project, add it with:

npm install winston

Here’s a basic setup:

const winston = require('winston');
const winstonGelf = require('winston-gelf');
const process = require('process');

const logger = winston.createLogger({
  transports: [
    new winston.transports.Console(),
    new winstonGelf({
      // See all gelfPro options here: https://www.npmjs.com/package/gelf-pro
      gelfPro: {
        fields: {
          env: process.env.NODE_ENV || 'development'
        },
        adapterName: 'udp',
        adapterOptions: {
          host: '<XXXXXX>.stackhero-network.com', // Replace with your Graylog domain
          port: 12201,
        }
      }
    })
  ]
});

// Example of an informational log
logger.info('This is a log information');

// Example of an error log
try {
  throw Error('This is an example error');
}
catch(error) {
  logger.warn({ message: 'Error triggered', error });
}

Don’t forget to configure your Graylog input (see details below).

Configuring the Graylog input

On the Graylog interface, go to System/Inputs, create a new input of type "GELF UDP," and click on "Launch new input." In the window that appears, check "Global," add a title, and confirm without changing any other settings.

That’s it! Your Graylog is now ready to receive logs from your Node.js application.

To improve security, consider filtering the IPs allowed to send data to port 12201. To do this, go to the Stackhero dashboard, select your Graylog service, and configure the "Firewall" to allow only your IPs.