graylog-clilisted

# Graylog CLI Skill Use the instance and rules below when constructing all Graylog API commands. ## Instances Update the table below with your Graylog instance URLs and credential file paths: | Environment | Base URL | Token File | |---|---|---| | Production | `https://<your-graylog-prod-url>` | `~/.graylog/prod.token` | | Staging | `https://<your-graylog-staging-url>` | `~/.graylog/staging.token` | If the target instance is unclear, ask the user before running any command. ## Prerequisites (one-time setup by user) Generate a Graylog API token (**System → Users → Edit Tokens**) for each instance and save it to the corresponding token file. Never print or display token values. Do not perform these steps yourself. ```bash mkdir -p ~/.graylog && echo "<your-api-token>" > <TOKEN_FILE> && chmod 600 <TOKEN_FILE> ``` ## Command Format Graylog uses the API token as the username with `token` as the password: ```bash curl -s -u "$(cat <TOKEN_FILE>):token" -H "X-Requested-By: cli" \ "<BASE_URL>/api/<endpoint>" | jq . ``` ## Available API Endpoints ### Read-only (safe, no confirmation needed) | Endpoint | Method | Description | |---|---|---| | `/api/search/universal/relative` | GET | Run a relative-time search query | | `/api/streams` | GET | List streams | | `/api/streams/<id>` | GET | Get a specific stream | | `/api/dashboards` | GET | List dashboards | | `/api/alerts` | GET | List triggered alerts | | `/api/system/indices/index_sets` | GET | List index sets | | `/api/s