This week I worked on setting up gralog2 for logging search and analysis.



  • Extractors cannot copy numeric fields.
  • Timestamp cannot be overrided using numeric field which is Unix Epoch. Use GELF or a string field.

URI configuration

It is confused to configure Graylog various URIs

  • rest_listen_uri specifies interface, port and path that Graylog will bind and listen incoming API requests.
  • rest_transport_uri is URI used by other nodes in a cluster. The default is reset_listen_uri, but if rest_listen_uri contains wild interface, it is replaced with the first non-loopback IPv4 address.
  • web_listen_uri specifies interface, port and path that Graylog will bind and listen incoming WEB interface requests.
  • web_endpoint_uri specifies how JavaScript accesses Graylog API, it can be overrided in HTTP header X-Graylog-Server-URL.

Use case: the server intranet IP is, public IP is

# Listen on all interfaces so it can be accessed locally by NGINX, and other nodes in cluster
rest_listen_uri =
# This is for other nodes in the intranet.
rest_transport_uri =
# Also listen on all interfaces
web_listen_uri =
# Set to NGINX or Load Balance address on all nodes
web_endpoint_uri =


I had added helper scripts to use fzf this week:

And their zsh completions

Also refactored a script to send text to tmux pane:

  • tt tmux send-keys wrapper

And tips I learned when implementing the scripts:

  • Indirect access variables in shell, zsh ${(P)a}, bash ${!a}.
  • Test if has prefix [[ test = t* ]]
  • Delete from array, zsh a[1]=(), bash unset a[1]

Check a value is in array in zsh:

  • ${v[(i)value]} returns index of value in array
  • ${v[(r)value]} returns value if it is in array, returns empty otherwise
[ “${array[(i)value]}” -le “${#array[@]}” ]

zsh-users/zsh-completions: Additional completion definitions for Zsh is a good getting started manual for zsh completion. Helper _arguments is enough for most simple command completion.