How can I get data from Graylog

I have an Obihai VOIP adaptor which I would like to use with OpenHAB to do some automation.

I’ve configured the Obihai to output syslog to Graylog which can send alerts for matching expressions via HTTP POST

I’m looking to get the ‘message’ into a String

Can someone tell me what the URL would be? How do I only get message?


To do this, you’ll need:

  • An openHAB Item to POST the raw JSON to
  • The openHAB REST URL, any data POSTed will come through as a command to that Item
  • GrayLog configured to POST to the openHAB REST URL
  • An openHAB rule to “unpack” the bits of the GrayLog message you’re interested in

Samples below, and references below…

Hope it helps!

openHAB Item declaration

String     TestJSONItem      "JSON Item [%s]"

openHAB REST URL for the Item


Sample log output POSTed to the Item
Here I used curl to test the POST command, per the SO link at the bottom, to simulate what GrayLog is going to send (using the example data from the link you provided).

2016-05-05 23:04:51 - TestJSONItem received command {    "check_result": {        "result_description": "Stream had 2 messages in the last 1 minutes with trigger condition more than 1 messages. (Current grace time: 1 minutes)",        "triggered_condition": {            "id": "5e7a9c8d-9bb1-47b6-b8db-4a3a83a25e0c",            "type": "MESSAGE_COUNT",            "created_at": "2015-09-10T09:44:10.552Z",            "creator_user_id": "admin",            "grace": 1,            "parameters": {                "grace": 1,                "threshold": 1,                "threshold_type": "more",                "backlog": 5,                "time": 1            },            "description": "time: 1, threshold_type: more, threshold: 1, grace: 1",            "type_string": "MESSAGE_COUNT",            "backlog": 5        },        "triggered_at": "2015-09-10T09:45:54.749Z",        "triggered": true,        "matching_messages": [            {                "index": "graylog2_7",                "message": "WARN: System is failing",                "fields": {                    "gl2_remote_ip": "",                    "gl2_remote_port": 56498,                    "gl2_source_node": "41283fec-36b4-4352-a859-7b3d79846b3c",                    "gl2_source_input": "55f15092bee8e2841898eb53"                },                "id": "b7b08150-57a0-11e5-b2a2-d6b4cd83d1d5",                "stream_ids": [                    "55f1509dbee8e2841898eb64"                ],                "source": "",                "timestamp": "2015-09-10T09:45:49.284Z"            },            {                "index": "graylog2_7",                "message": "ERROR: This is an example error message",                "fields": {                    "gl2_remote_ip": "",                    "gl2_remote_port": 56481,                    "gl2_source_node": "41283fec-36b4-4352-a859-7b3d79846b3c",                    "gl2_source_input": "55f15092bee8e2841898eb53"                },                "id": "afd71342-57a0-11e5-b2a2-d6b4cd83d1d5",                "stream_ids": [                    "55f1509dbee8e2841898eb64"                ],                "source": "",                "timestamp": "2015-09-10T09:45:36.116Z"            }        ]    },    "stream": {        "creator_user_id": "admin",        "outputs": [],        "matching_type": "AND",        "description": "test stream",        "created_at": "2015-09-10T09:42:53.833Z",        "disabled": false,        "rules": [            {                "field": "gl2_source_input",                "stream_id": "55f1509dbee8e2841898eb64",                "id": "55f150b5bee8e2841898eb7f",                "type": 1,                "inverted": false,                "value": "55f15092bee8e2841898eb53"            }        ],        "alert_conditions": [            {                "creator_user_id": "admin",                "created_at": "2015-09-10T09:44:10.552Z",                "id": "5e7a9c8d-9bb1-47b6-b8db-4a3a83a25e0c",                "type": "message_count",                "parameters": {                    "grace": 1,                    "threshold": 1,                    "threshold_type": "more",                    "backlog": 5,                    "time": 1                }            }        ],        "id": "55f1509dbee8e2841898eb64",        "title": "test",        "content_pack": null    }}

openHAB Rule to extract the “1st” message in the result

rule "JSON Test"
    Item TestJSONItem received command
    var String msg = transform("JSONPATH", "$.check_result.matching_messages[0].message", receivedCommand.toString)
    logInfo("jsont", "msg:" + msg)


1 Like

Hi Mark,

Thanks for the excellent response - much appreciated!

I’ve setup as you suggested but I have an issue in that it is generating a HTTP 415 error when trying to POST

From what I read, this is due to the content type not being matched.

Would this be something that would have to be changed at the Graylog side?

Yes, either that or the openHAB termination points would need to relax this rules to allow ‘any’ of the textual input formats, not just text/plain

IIUC, it’s this annotation that would need to be lightened up: