# Graylog3 (3.0.2) as datasource for streams (?) and firewall logs

**URL:** <https://community.grafana.com/t/graylog3-3-0-2-as-datasource-for-streams-and-firewall-logs/24417>\
**Category:** Elasticsearch\
**Created:** [January 6, 2020, 10:15am UTC](https://community.grafana.com/t/graylog3-3-0-2-as-datasource-for-streams-and-firewall-logs/24417 "2020-01-06T10:15:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![denny](https://avatars.discourse-cdn.com/v4/letter/d/9de053/32.png) [@denny](https://community.grafana.com/u/denny)\
**Post date:** [January 6, 2020, 10:15am UTC](https://community.grafana.com/t/graylog3-3-0-2-as-datasource-for-streams-and-firewall-logs/24417/1 "2020-01-06T10:15:51Z")

</div>

hi,

we have the lates Grafana version and Graylog 3.0.2. My goal was to add a (ELK) datasource for creating graphs from our Fortigate logs and blocks. What ever I try, it fails and I get a 404. Our Graylog ULR is [https://graylog.example.com/](https://graylog.example.com/) (no port) and we have authentication enabled. Also I tried to play with the index (graylog\_\* / graylog\_0 … etc) … but no success. I have only a 404.  
If I test the source:

```
192.168.x.x - - [06/Jan/2020:09:50:34 +0100] "GET /graylog_%2A/_mapping HTTP/1.1" 200 455 "-" Grafana/6.5.2"

```

The "%2A comes from the Index grafana\_\*.

Our graylog is behind a Apache2 reverse proxy [https://graylog.example.com/](https://graylog.example.com/) which forwards everything to the internal Graylog host and port.  
If I try to use the ELK datasource:

```
192.168.x.x - - [06/Jan/2020:09:53:14 +0100] "POST /_msearch HTTP/1.1" 404 50 "-" "Grafana/6.5.2"

```

which results in a 404.

Question is: How can I get the streams / logs into my Grafana Dashboard

Any suggestions ?