IoT Sensor Data into Graylog: A Lab Guide

Graylog has always been associated with log management, metrics, SIEM and security monitoring—but it’s also a great tool for creative, low-cost experiments in a home lab. I wanted to use it for real-world sensor data, so I built a DIY temperature and humidity monitor using an ESP-WROOM-32 development board and a DHT22 sensor. This project shows you how to create a lightweight API endpoint on the ESP32, poll it regularly using Graylog’s HTTP API input, and visualize the results in a live dashboard.

I wanted a way to integrate temperature and humidity status into Graylog and send alerts for temperature and low humidity for my equipment room.  Really, my guitar room! I wanted to ensure the humidity was not going below a certain level, potentially causing damage to my prized guitars.

Hardware Used

• ESP-WROOM-32 (ESP32) development board
• DHT22 Digital Temperature & Humidity Sensor
• A few jumper wires
• A WiFi Network for it to connect to
• A Graylog Instance on the same network
• An HTTP API Input configured on Graylog

DHT22 Sensor

The DHT22 data pin is connected to GPIO4. Power comes from the ESP32’s 3.3V rail.

Wiring It Up

The Arduino Code

Arduino is a great way to experiment with many sensors and modules. With most ESP32 boards having WiFi, Bluetooth and a very large community you can almost do anything. You will require the Arduino IED on Windows or Linux to load the code onto an ESP32 Module.  There many aftermarket ESP32 boards so finding the correct board in the IDE can be tricky.  A little trial and error might be necessary.

How This Setup Works

The ESP32 hosts a web server on port 80. When a GET request is sent to “http://ipaddress/sensor”, it responds with the current temperature (in both Celsius and Fahrenheit) and humidity in JSON format. I used the AsyncWebServer, DHT, and ArduinoJson libraries.

Here’s the code running on the ESP32:

#include <WiFi.h>
#include <AsyncTCP.h>
#include <ESPAsyncWebServer.h>
#include <DHT.h>
#include <ArduinoJson.h>

// http://<ESP32_IP>/sensor (how to poll the data)

// WiFi credentials
const char* ssid = "ssidname";
const char* password = "ssidpassword";

// Define DHT type & GPIO
#define DHTPIN 4
#define DHTTYPE DHT22

DHT dht(DHTPIN, DHTTYPE);
AsyncWebServer server(80);

// Define device location
const char* deviceLocation = "Room Location"; // Change this to machine your sensor location

void setup() {
  Serial.begin(115200);
  dht.begin();

  WiFi.begin(ssid, password);
  while (WiFi.status() != WL_CONNECTED) {
    delay(1000);
    Serial.println("Connecting to WiFi...");
  }
  Serial.println("Connected to WiFi");

  server.on("/sensor", HTTP_GET, [](AsyncWebServerRequest *request){
    float tempC = dht.readTemperature();
    float tempF = dht.readTemperature(true);
    float humidity = dht.readHumidity();

    if (isnan(tempC) || isnan(tempF) || isnan(humidity)) {
      request->send(500, "application/json", "{\"error\":\"Failed to read from DHT sensor\"}");
      return;
    }

    StaticJsonDocument<200> jsonDoc;
    jsonDoc["location"] = deviceLocation;
    jsonDoc["temperature_C"] = tempC;
    jsonDoc["temperature_F"] = tempF;
    jsonDoc["humidity"] = humidity;

    String jsonResponse;
    serializeJson(jsonDoc, jsonResponse);
    request->send(200, "application/json", jsonResponse);
  });

  server.begin();
}

void loop() {
  // Nothing needed in loop since server runs asynchronously
}

The Output

Once it’s running, you  can visit http://<ESP32_IP>/sensor to get output like this:

{
"location": "Location Name",
"temperature_C": 20,
"temperature_F": 68,
"humidity": 44.1
}

Getting Data into Graylog

To get this data into Graylog, I set up an HTTP API input. This input type is perfect for ingesting structured JSON from IoT devices or scripts. Note: I did not setup advanced token security or any other more secure setup. This could include an API key in your Arduino setup.  This was for basic use and always for best practice, secure your stuff.

Here’s the approach:

• The ESP32 code doesn’t push data—it just serves it in this case.
• I scheduled the input to poll every 6 hours
• It hits the /sensor endpoint, and then pulls the data to Graylog.

Visualizing It in Graylog

Once the data is flowing in, it’s easy to build a dashboard that gives you a real-time view of your environment. I created widgets to show temperature and humidity over time, and also added gauges for current values.

If you want to get creative, you can even trigger alerts for thresholds—like if the humidity spikes or the temp drops below safe levels for a server rack or in my case, the guitar room 🙂

Ideas for Future Expansion

• Add multiple sensors and Graylog inputs for different rooms
• Include motion or door sensors
• Combine sensor data with home firewall logs to correlate physical presence with network activity
• Use anomaly detection to flag environmental shifts

Final Thoughts

This was a fun way to get another project into Graylog alerts. Feeding in structured JSON from a homemade sensor opens the door to a wide range of creative monitoring setups.

If you try something similar or take it further, I’d love to hear about it.