Configuring Graylog Permissions and MCP Server

How to Query Graylog With Claude Using MCP

Log management is entering a new phase, and surprisingly, the biggest obstacle isn’t a lack of data. It’s the gap between having it and actually querying it.

This session, part of Graylog’s Getting the Most out of Graylog Open series, connects Claude to a live Graylog instance and runs the queries an analyst would actually type.

During this session, Graylog’s Jeff Darrington will set up Claude Code on Windows, connect it to Graylog’s MCP server, and show what natural language queries look like against real streams, alerts, and investigations.

You’ll learn more about:

  1. How a plain language prompt travels from Claude to Graylog and back
  2. Where Graylog Open and Security diverge on what Claude can query
  3. What it takes to connect Claude Code to Graylog on Windows
  4. How natural language prompts create and update investigations without leaving the chat
  5. Practical setup steps and the gotchas that trip up a first connection