Graylog Server

The NetFlow plugin is designed to receive data from Flow exporters and convert them into Graylog messages.

Compatibility:

• Required Graylog version: 2.3.0 and later.

Supported Versions & Features:

• NetFlow V9: Full support.
• IPv6: Supports IPv6 addresses without conversion.
• NetFlow V5: Handles all fields from the fixed V5 format.
• Cisco ASA 5500: Supports events from Cisco ASA 5500, including firewall and routing events (Note: there may be significant duplication of typical syslog reporting in v9 reporting).

Graylog manages Opensearch configuration using two distinct approaches to ensure the correct settings are applied to the runtime environment:

1. Common Configuration: Files located in main/resources/opensearch/config/common are considered base configuration. These files are copied to the managed Opensearch process's read-write location during every process start. This action overrides any existing files from previous runs.
2. Version-Specific Configuration: Files located in subdirectories named after the Opensearch SemVer (e.g., main/resources/opensearch/config/2.19.5) are copied specifically for that version.

During startup, the system combines these two sources to prepare the runtime configuration.

To build the plugin from source, you need Maven 3 and Java 8 or higher.

1. Clone the repository.
2. Build the JAR file using mvn package.
3. (Optional) Create DEB or RPM packages using mvn jdeb:jdeb and mvn rpm:rpm.
4. Copy the generated JAR from the target directory to your Graylog plugin directory.
5. Restart Graylog.

mvn package
# Optional: create packages
mvn jdeb:jdeb
mvn rpm:rpm

To improve the development experience for the web interface portion of your plugin, you can use hot reloading by linking your plugin into the Graylog web interface directory. Follow these steps:

1. Clone the Graylog server repository.
2. Navigate to the graylog2-web-interface directory.
3. Create a symbolic link from your plugin directory to the plugin/ directory.
4. Install dependencies and start the development server.

git clone https://github.com/Graylog2/graylog2-server.git
cd graylog2-server/graylog2-web-interface
ln -s $YOURPLUGIN plugin/
npm install && npm start

The Graylog Web Interface uses a GraylogThemeProvider (defined in src/theme/GraylogThemeProvider.jsx) to wrap the application. This provider makes the global theme object available to all components via the theme prop through styled-components.

To use theme values (such as colors) in your styled components, destructure theme from the props function within a styled declaration.

const StyledElement = styled.div(
  ({ theme }) => css`
    background-color: ${theme.colors.global.contentBackground};
  `,
);

Plugin builds inheriting from graylog-plugin-parent or graylog-plugin-web-parent now enforce the requireUpperBoundDeps rule. This rule fails the build if a transitive dependency resolves to a version lower than what another dependency in the plugin requires.

To resolve build failures:

1. Update the outdated dependency to the required version.
2. Or, add a <dependencyManagement> entry for the flagged artifact using the highest required version indicated in the error message.
3. If you cannot align dependencies, you can override the enforce-versions execution of the maven-enforcer-plugin in your own POM.

While the online documentation is available at https://graylog2.github.io/frontend-documentation/, you can run a local version to contribute or view different branches:

1. Navigate to the docs directory: cd docs
2. Install dependencies: yarn install
3. Start the documentation server: yarn run docs:server
4. Access the documentation at http://localhost:6060.

Graylog uses a consistent convention for indicating required fields. Do not use the word "optional" for non-required fields; instead, simply leave them unmarked.

To mark a required field, use the <RequiredMarker /> component from components/common.

import { RequiredMarker } from 'components/common';

When running the archetype:generate command, you will be prompted to define several properties. Key properties include:

• groupId: The Maven group ID for your plugin (e.g., org.graylog.plugins).
• artifactId: The unique identifier for your plugin project (e.g., graylog-plugin-twitter).
• package: The Java package name where your code will reside (e.g., org.graylog.plugins.twitter).
• pluginClassName: The name of the main class that implements the Graylog plugin interface (e.g., Twitter).