🔍 Sometimes a side project starts with a work problem, not a homelab problem. This one did: I’m currently wrangling Graylog as a log management platform professionally, and needed proper monitoring check plugins for it — for both Icinga2 and Zabbix. Surely someone already solved this, right? Right?? 😅
📉 The Disappointing Part: Searching Google and GitHub
My first move was the obvious one — go find someone who already built this, because reinventing wheels is for suckers. The results were, to put it kindly, underwhelming. Whatever existed was either extremely minimal (one hardcoded check, zero thresholds, the monitoring equivalent of a smoke detector with no battery) or genuinely ancient — some repos hadn’t seen a commit in up to ten years. Graylog’s REST API has changed a fair amount since the last time these plugins were touched by human hands. Not exactly confidence-inspiring as a monitoring foundation. 🦕
💡 The Slightly Unhinged Idea
So I had what I’ll generously call a “glorious idea”: have Claude spin up Graylog, Icinga2, and Zabbix on my own server via Docker Compose, and just… build the check plugins from scratch, testing everything live against a real running instance instead of copy-pasting from a decade-old blog post and hoping for the best. 🐳
I asked ChatGPT for a list of the most important checks and metrics worth monitoring on Graylog — journal utilization, indexer cluster health, input states, throughput, node health, that sort of thing. Then the actual assignment for Claude was: implement the checks, test the real API calls against a live instance, and correct/validate the JSON parsing against what Graylog actually returns, not what documentation from three major versions ago insists it returns.
🧠 Where Trained Knowledge Ran Out
Claude had a reasonable amount of pre-existing knowledge about Graylog’s REST API baked in from training — endpoint names, general shape of things. Some of it held up fine. Some of it very much did not: a couple of assumed JSON field names simply don’t exist anymore, and at least one endpoint’s behavior (a load-balancer status check that signals state via the raw HTTP status code instead of a JSON body, because why make it easy) was quietly wrong from day one. Turns out guessing from memory only gets you so far against an API that’s had three years to drift. 🎯
What actually closed the gap: I handed Claude a full OpenAPI export pulled straight from my own Graylog instance. That let it cross-check every assumed endpoint and field name against the real, current spec — and then, since I also let it build the live Docker test environment, it could go one step further and actually execute the calls instead of just reading about them like some kind of API tourist. Both real bugs it found this way only showed up at runtime, not from reading documentation. 🐛➡️✅
Bonus plot twist: partway through, I noticed the whole test rig had quietly been running against Graylog 6.1, while the OpenAPI spec I’d handed over was for 7.1.3. Classic “it works on my (wrong) machine” moment. Caught it mid-review, had the environment rebuilt against the correct version, and made Claude re-run the entire test suite end to end out of sheer paranoia. Good news: both bugs found were identical on both versions — nothing version-specific, just genuinely wrong assumptions all along. Still, better to fess up to the mismatch than quietly pretend it never happened. 🙈
✅ The Result
Two separate, properly native check implementations came out of this — not one duct-taped around the other and called a day. Icinga2 gets a classic Nagios-style plugin (exit codes, OK/WARNING/CRITICAL, perfdata, the works). Zabbix gets its own idiomatic version instead, where each check reports a raw value and the actual thresholds live in Zabbix triggers — because that’s how Zabbix wants to be fed, not because native mode was the lazy option (it very much was not — ask me about parsing Zabbix’s Low-Level Discovery JSON format sometime). Both were tested against a live, running Icinga2/Zabbix instance too, not just against Graylog in isolation — including watching a real Zabbix trigger actually flip to “problem” state on cue, which produced an unreasonable amount of satisfaction for a Saturday. 📡
Everything — plugins, setup instructions, and full documentation — is public:
github.com/aptupgrademe/graylog-checks
If you’re stuck monitoring Graylog with a decade-old Nagios script from a random GitHub repo, hopefully this saves you the archaeology. 🏺
