Skip to content
downpipes docs

Forward the downpipes audit trail to Graylog

Graylog receives the downpipes audit trail through a GELF HTTP input. The engine dials out to the input on the scheduler tick and posts the audit events as GELF, one GELF object per line.

One setting on the GELF HTTP input is load-bearing: Enable Bulk Receiving. The engine batches many events into each POST, and without Bulk Receiving Graylog reads only the first GELF object in the body and silently drops the rest. Turn it on before you enable the destination.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

What you need

  • A Graylog role that can create and edit a GELF HTTP input.
  • The input’s URL (default port 12201) and owner access to the downpipes console.

Set it up

  1. In Graylog, open System, Inputs, and create a GELF HTTP input. Launch it on a node, and note the host and port (the default is 12201).
  2. On that input, turn on Enable Bulk Receiving. This is the step Graylog needs: without it, a batched POST lands only its first event and the rest are dropped.
  3. Put the input behind HTTPS with a header check. The engine sends only over HTTPS and always sends an auth header, and a bare GELF HTTP input has neither TLS nor authentication, so terminate TLS and validate a header token at a reverse proxy (or load balancer) in front of the input.
  4. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, asks for a fresh step-up sign-in).
  5. Set the sink to HTTPS endpoint, the format to GELF, and paste the HTTPS URL that fronts the input (for example https://graylog.example.com/gelf).
  6. Set the auth header name and value to the token your proxy checks.
  7. Choose Test send and confirm the event lands in Graylog, then Enable the destination.

What lands in Graylog

Each event arrives as one GELF object, newline-delimited in the body (which is why Bulk Receiving matters):

{"version":"1.1","host":"downpipes","short_message":"restore-approve success","timestamp":1751681648.221,"level":6,"_seq":4097,"_actorEmail":"ops@acme.example","_action":"restore-approve","_outcome":"success","_targetKind":"restore","...":"..."}

Graylog reads short_message, timestamp and level, and every audit field arrives as a custom _-prefixed field (_action, _outcome, _actorEmail and so on), so you can search and build streams on them.

Good to know

  • Enable Bulk Receiving, or you lose all but the first event of each batch. The engine posts many GELF objects in one body; a GELF HTTP input without Bulk Receiving keeps only the first and drops the rest silently.
  • level reflects the outcome, and delivery is at-least-once. It is 3 (error) for a failed event, 4 (warning) for a denied one, and 6 (info) otherwise; dedup on _seq or _hash. The feed carries operator identity (member emails, source IPs, roles and approver emails); no backup data and no secret values. For the shared push mechanics and the pull alternative, see forwarding the audit log to your SIEM.

Last updated .