GraylogStore — Graylog centralized log management

GraylogStore — Graylog centralized log management Overview Graylog is a centralized log-management platform. Logs are ingested in GELF (Graylog Extended Log Format) over an HTTP input, and searched via the REST universal-search API. There is no SQL-shaped query surface, no row-level UPDATE/DELETE, and no identifier escaping, so Graylog does not fit the SQL Dialect interface (src/dialects/dialect.ts). GraylogStore therefore implements the minimal NoSqlStore marker interface (src/nosql/store.ts) — connection lifecycle plus a getClient() escape hatch — and exposes Graylog's GELF HTTP ingest input and its REST universal-search / metadata API directly. Identity: Property | Value | --------- | ------------ | name | 'graylog' | library | 'fetch' | No canonical driver — HTTP over fetch Graylog has no single canonical npm client; it is an HTTP/JSON API. This store talks to it with the global fetch (so library is 'fetch'). When no client is injected, an internal client over fetch + baseURL is built at connect() time by createFetchClient(baseURL, headers) (its GET sends Accept: application/json). Injected client GraylogStoreOptions accepts a pre-built client implementing the GraylogHttpClient interface. When provided it is used verbatim and baseURL is ignored — this is how the test suite injects a mock (no network). Connection Option | Type | Purpose | --------- | ------------------------ | ------------------------------------------------------------------------ | baseURL | string | Base URL of the Graylog REST API. Defaults to http://localhost:9000. | client | GraylogHttpClient | Pre-built HTTP client. When set, baseURL is ignored. | headers | Record<string, string> | Extra HTTP headers (e.g. Authorization) sent with every request. | Note: Graylog's GELF HTTP input conventionally listens on port 12201 while the REST API is on 9000. This store posts GELF to <baseURL>/gelf, so point baseURL at whichever host serves both the /gelf input and the REST API in your deployment. Injected-client form Methods Metadata/search reads route through an internal doGet, which wraps any client failure in a DatabaseError. Calling a method before connect() (or after disconnect()) throws a ConnectionError. Lifecycle Method | Signature | Behavior | ------------- | --------------------------------- | ---------------------------------------------------------------------------------------------------- | connect | connect(): Promise<void> | Uses an injected client if provided, otherwise builds a fetch client from baseURL. Idempotent. | disconnect | disconnect(): Promise<void> | Clears the client and connection state. | isConnected | isConnected(): boolean | true only when connected and a client is present. | getClient | getClient(): GraylogHttpClient | Returns the underlying (internal or injected) client. Throws ConnectionError if not connected. | Ingest / search / metadata Method | Signature | Endpoint | Behavior | --------- | ------------------------------------------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------- | push | push(host: string, entries: GraylogEntry[]): Promise<any> | POST /gelf | Ingests entries as GELF 1.1 messages. Each entry is completed with { version: '1.1', host, ...entry } and messages are newline-delimited (one JSON message per line). | query | query(q: string, options?: GraylogQueryOptions): Promise<any> | GET /api/search/universal/relative | Runs a relative universal search. Returns the parsed response ({ messages, totalresults, fields, ... }). Defaults range to 300. | labels | labels(): Promise<any> | GET /api/system/fields | Lists the known message field names. | streams | streams(): Promise<any> | GET /api/streams | Lists the configured streams. | Option / entry shapes Example Verification status Unit / mock-verified only. The tests in tests/nosql/graylog.test.ts are fully mock-driven: an in-memory GraylogHttpClient that records every request and returns canned responses is injected via GraylogStoreOptions.client. There is no live Graylog server and no network in the test run. What this proves: push posts newline-delimited GELF 1.1 messages to /gelf, merging version/host into each entry. query targets /api/search/universal/relative with query/range (default 300) and passes through limit/sort. labels/streams route to the fields/streams endpoints. Lifecycle: idempotent connect(), getClient() returning the injected client, and ConnectionError before connect(). Error handling: client failures wrapped in DatabaseError. What this does not prove: live execution against a real Graylog deployment. Request/response shapes are verified against Graylog's documented GELF/REST contract, but end-to-end execution over the wire has not been exercised here. Related reading All data stores — the full catalogue, grouped by purpose Database types — where this sits among the 22 categories