Graylog integration
Page your on-call engineer from Graylog alerts
Point a Graylog HTTP Notification at Oncallz and every event becomes an incident that pages whoever is on call. Oncallz reads Graylog's own payload shape, including the log level of the backlog messages, so an error line is not downgraded to a warning.
Set up Graylog → Oncallz in a few minutes
- 1 In Oncallz, open Integrations, pick the team that should be paged, enter a name such as "Graylog prod", set Duplicate events to "Group by title" and click Create.
- 2 Copy the Inbound URL shown on the new integration. It looks like https://oncallz.com/api/ingest/ followed by the routing key.
- 3 In Graylog, go to Alerts → Notifications, click Create notification and choose HTTP Notification. Paste the Oncallz URL. If your Graylog enforces a URL allowlist, add the URL there first or the request is blocked.
- 4 Open the event definition you want to page on (Alerts → Event Definitions), attach the new notification in its Notifications step and include a message backlog so Oncallz can read the log levels.
- 5 Trigger the event, or use Graylog's test button on the notification, and check that the incident appears in Oncallz with the expected severity.
The Graylog fields Oncallz uses
{
"event_definition_title": "Payments - DB connection lost",
"event": {
"id": "01J9Z6Q2XK8M4",
"message": "Payments - DB connection lost",
"source": "graylog-node-1",
"priority": 2,
"fields": { "details": "MySQL server has gone away (err 2006)" }
},
"backlog": [
{ "fields": { "stringLevel": "Error", "level": 3 } }
]
}Title: event.message. Description: event.fields.details. Source: event.source. Severity: the worst backlog level (Error here), even though the event priority is only 2.
How is severity decided for Graylog events?
Oncallz takes the most severe log level found in the event's backlog messages. It reads the structured stringLevel and numeric syslog level fields, never the free text, so wording inside a log line cannot change the severity.
Only when there is no backlog does it fall back to the numeric event priority.
- Backlog levels: emergency, alert, critical or fatal (syslog 0–2) become critical; error (3) becomes error; warning (4) becomes warning; notice, info and debug (5+) become info.
- Without a backlog: event priority 1 becomes info, 2 becomes warning, 3 or higher becomes critical.
- Your per-severity channel settings then decide whether that incident rings a phone, sends an SMS or only pushes and emails.
How are repeated Graylog alerts grouped?
Graylog gives every event a new event.id, so grouping by ID does not fold repeats together. Use "Group by title" instead: while an incident with the same title is open, new events are added to its timeline and its occurrence count goes up, and nobody is paged again.
Aggregation alerts often put a changing number in the title, such as "Token failures: count()=91.0". Add a title grouping template under Settings, for example "Token failures: count()=*", and those titles collapse into one incident.
Does a Graylog incident resolve itself?
No. Graylog HTTP Notifications are sent when an event fires; Graylog does not send a recovery message. The on-call engineer resolves the incident in Oncallz from the web app or the iOS app. Once it is resolved, the next matching event opens a fresh incident.
What does the on-call engineer receive?
A page on the channels set for that severity: push notification, SMS, phone call or email. The incident shows the title, the log line from event.fields.details when your event definition defines a "details" field, the source node and the full Graylog payload.
If you have connected your own AI provider key, an AI summary with a probable cause is attached before the page goes out.
Taming noisy streams
Maintenance windows can drop, mute or lower the severity of matching events during planned work. Call suppression rules match a regular expression against the title or description and skip only the phone call, so known-noisy alerts still reach push, SMS and email.
Frequently asked questions
Do I need a Graylog plugin to use Oncallz?
No. Graylog's built-in HTTP Notification is enough. Create it under Alerts → Notifications, paste your Oncallz inbound URL and attach it to an event definition. Oncallz recognises Graylog's payload on its own, so you do not need a custom body template.
If your Graylog uses a URL allowlist, add the Oncallz URL to it first.
Why does Oncallz show Error when my event definition priority is Normal?
Because Oncallz prefers the real log level of the backlog messages over the event definition priority. An error logged under a normal-priority definition is still an error, so it is paged as one.
If the event carries no backlog, Oncallz uses the numeric event priority: 1 is info, 2 is warning and 3 or higher is critical.
Will Oncallz resolve the incident when the Graylog condition clears?
No. Graylog sends a notification when an event fires but sends nothing when the condition stops matching, so there is no recovery signal to act on. Someone on the team resolves the incident in Oncallz.
While it stays open, new events with the same title are added to it instead of paging again, as long as the integration groups by title.
How do I stop one noisy alert from ringing phones all night?
You have three options. Group by title, with a title template for changing numbers, so repeats fold into one open incident. Add a call suppression rule that matches the alert text, which skips only the phone call.
Or schedule a maintenance window that drops, mutes or lowers the severity of matching events during planned work.
Can I send one Graylog notification to several Oncallz teams?
Each Oncallz integration belongs to one team and has its own URL. Create an integration per team and a matching HTTP Notification in Graylog for each, then attach the right notification to each event definition.
That way database alerts page the database rotation and application alerts page the application rotation.
Related pages
- New Relic Send New Relic alert notifications to Oncallz: incidents open, page the on-call engineer and resolve themselves when New Relic closes the issue.
- AI investigation Before it pages, Oncallz summarises the alert and suggests a probable cause and next step; optionally it skips the phone call for clear noise. Your own AI key.
- Phone & SMS alerting Page on-call engineers by phone call, SMS, push and email by severity — and let them acknowledge or escalate from the phone keypad.
Ready when the pager goes off.
Create your workspace in minutes. Free to start, no credit card — $4 per user a month when you’re ready.