graylog-cli

Use graylog-cli search with a Lucene query, for example graylog-cli search "level:<=3" --since 1h --field message --field source. Authenticate first with graylog-cli auth --url <URL> --token <TOKEN>, then pipe the JSON output through jq for filtering.

Graylog stores level as a numeric field from 0 to 7, so use range queries like level:<=3 to match Emergency through Error. Text values like level:ERROR will not match; combine the numeric filter with other conditions using AND.

Yes, graylog-cli supports named profiles stored in a single config.toml file. Switch the active profile with graylog-cli profiles use <name>, or target another instance for one command with the global --profile flag or GRAYLOG_PROFILE environment variable.

The most common cause is using text level names instead of numeric values, since level is stored as 0-7. Also verify your time range covers the expected period and widen it with --time-range 1d if needed.

The Graylog API returns at most 500 messages per page, and the --all-pages flag paginates automatically up to a hard limit of 10,000 messages. When truncated, metadata.truncated is set to true, so narrow the query or time range for larger result sets.

Aggregations fail on analyzed text fields like message. Use keyword fields such as source, level, ExceptionType, or correlationId instead, and only pass --interval when using the date_histogram aggregation type.