Where Does Graylog Store Config and Journal?
Graylog server config and journal paths on Linux for self-hosted log management clusters. And restore steps.
Last updated
Graylog keeps node settings in /etc/graylog/server.conf with secrets, inputs, and retention. Log data itself lives in OpenSearch with metadata in MongoDB per that config. The file ties the cluster together.
Incoming messages buffer in a journal folder before indexing. That folder absorbs bursts during outages. Back up the config with database dumps. Journal contents drain on restart, configs persist behavior. Streams route messages by rule. Dashboards chart error rates. Alerts ping chat on spikes.
Where Graylog stores this, by platform
/etc/graylog/server.conf
Secrets, inputs, and retention settings for the node. Restrict read access since passwords live here. Keep with database dumps.
/var/lib/graylog/journal
Burst buffer before OpenSearch indexing. Size for outage windows on busy shippers. Copy with Graylog stopped for consistency.
Frequently asked questions
what do i back up for a Graylog move
Copy /etc/graylog with the journal and Mongo plus OpenSearch dumps. The config holds secrets and inputs. Logs live in OpenSearch. All pieces restore search.
where are Graylog received logs stored
Open server.conf in /etc/graylog to read data and journal lines. Messages default through the journal into OpenSearch. The file decides retention. Check version paths.
Notice an outdated path? Let us know.