Notes about Graylog

Navigating Graylog

Web resources

To find all files which describe web resources do a search for @Path in graylog2-server/src/main/java:

grep -rn "@Path"

The extreme majority are REST resources.

Persistence

The namespace which contains the bases classes used for database persistence is org.graylog2.database. There seems to be two possible ways to implement a service which handles persisted data:

• PaginatedDbService seems to be used with DTOs (Data Transfer Objects) which are used by the REST API? (Such as the NotificationDto and EventDefinitionDto). Relies on org.mongojack.JacksonDBCollection (mongojack 2.10).
• PersistedServiceImpl seems to be for objects which are more internal? Relies on com.mongodb.DBCollection (mongodb-driver-legacy 4.8).

Architecture

Classes

• org
  • graylog
    • events
      • event.EventDto: data object which represents events
      • notifications.EventNotificationContext
      • processor.EventProcessor: Parent interface of all classes which create events. Implemented by org.graylog.events.processor.aggregation.AggregationEventProcessor and org.graylog.events.processor.systemnotification.SystemNotificationEventProcessor.
      • search.EventsSearchService
      • rest.EventsResource: API entry point for /events/search and /events/{event_id}
    • scheduler.JobTriggerDto
  • graylog2
    • database
      • DbEntity
      • PaginatedDbService
      • PersistedServiceImpl: services which require persistence (in Mongo) of the object they manage extend this service
    • streams.StreamRuleServiceImpl: example of a service which extends org.graylog2.database.PersistedServiceImpl

Other plugins

• https://github.com/Graylog2/graylog-plugin-integrations