# Traefik 2 & Graylog

**URL:** <https://community.traefik.io/t/traefik-2-graylog/5988>\
**Category:** Traefik v2\
**Tags:** tcp\
**Created:** [May 11, 2020, 2:51pm UTC](https://community.traefik.io/t/traefik-2-graylog/5988 "2020-05-11T14:51:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lachnerd](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lachnerd/32/1056_2.png) [@lachnerd](https://community.traefik.io/u/lachnerd)\
**Post date:** [May 11, 2020, 2:51pm UTC](https://community.traefik.io/t/traefik-2-graylog/5988/1 "2020-05-11T14:51:54Z")

</div>

Hi there,

i have graylog behind traefik v2.1 let's say under "[graylog.mydomain.com](http://graylog.mydomain.com)".  
Traefik is listening on Port 80 and 443 and redirecting 80 to 443.  
It's SSL secured with a Wildcard Lets Encrypt Certificate for "\*.mydomain.com".

Can i add transparent TCP Routers for different Input-Streams without opening specific Ports on the graylog-service.

For example:

- TCP on [app01.mydomain.com:443](http://app01.mydomain.com:443) -\> that gets to Port 50001
- TCP on [app02.mydomain.com:443](http://app02.mydomain.com:443) -\> that gets to Port 50002  
...

I get some TCP Routes but they are not working.  
If i open Port 50001 on my graylog Service i can output some testdata to it but only with open Ports.  
Not over 443 or even 80.

Is this even possible or am i doing completely wrong here?

Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [May 11, 2020, 5:04pm UTC](https://community.traefik.io/t/traefik-2-graylog/5988/2 "2020-05-11T17:04:22Z")

</div>

Hi @lachnerd

Yes that sounds like a normal use case for TCP router. Care to share your config ?

---

<div class="post-metadata">

**Author:** ![lachnerd](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lachnerd/32/1056_2.png) [@lachnerd](https://community.traefik.io/u/lachnerd)\
**Post date:** [May 12, 2020, 9:44am UTC](https://community.traefik.io/t/traefik-2-graylog/5988/3 "2020-05-12T09:44:56Z")

</div>

Hi @cakiwi,

sure - i managed to get a little bit further with my problem.

If i use the following config:

```auto
traefik.enable: 'true'
# http web 80
traefik.http.routers.graylog-web.rule: Host(`graylog.mydomain.com`)
traefik.http.routers.graylog-web.middlewares: redirect@file
traefik.http.routers.graylog-web.entrypoints: web
# http websecure 443
traefik.http.routers.graylog-websecure.rule: Host(`graylog.mydomain.com`)
traefik.http.routers.graylog-websecure.tls: 'true'
traefik.http.routers.graylog-websecure.entrypoints: websecure 
traefik.http.routers.graylog-websecure.middlewares: graylogheader@file,errorhandler@file,compress@file
traefik.http.services.graylog-websecure.loadbalancer.passHostHeader: 'true'
traefik.http.services.graylog-websecure.loadbalancer.server.port: '9000'
# tcp
traefik.tcp.routers.log-test-router.rule: HostSNI(`*`)
traefik.tcp.routers.log-test-router.service: log-test-service
# use port 80
traefik.tcp.routers.log-test-router.entrypoints: web
# port of graylog input is listening to
traefik.tcp.services.log-test-service.loadbalancer.server.port: '50101'

```

And test it with:

```auto
echo -e '{"version": "1.1","host":"example.org","short_message":"Short message","full_message":"Backtrace here\n\nmore stuff","level":1,"_user_id":9001,"_some_info":"foo","_some_env_var":"bar"}\0' | nc -w 1 test.mydomain.com 80

```

I get proper inputs on the received messages in my graylog backend that is configured to port 50101 - seems to work fine.

but if i use:

```auto
# tcp
traefik.tcp.routers.log-test-router.rule: HostSNI(`test.mydomain.com`)
traefik.tcp.routers.log-test-router.service: log-test-service
# use port 80
traefik.tcp.routers.log-test-router.entrypoints: web
# port of graylog input is listening to
traefik.tcp.services.log-test-service.loadbalancer.server.port: '50101'

```

i get the following

```auto
HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Connection: close

```

But finally i want this also to get working over TLS.

---

<div class="post-metadata">

**Author:** ![lachnerd](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lachnerd/32/1056_2.png) [@lachnerd](https://community.traefik.io/u/lachnerd)\
**Post date:** [May 12, 2020, 10:04am UTC](https://community.traefik.io/t/traefik-2-graylog/5988/4 "2020-05-12T10:04:56Z")

</div>

i think i found an answer in traefik docs

 ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/f/f628e5fa40ad21225e4aa01624b2e5bb233af6e2.png)

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [May 12, 2020, 12:00pm UTC](https://community.traefik.io/t/traefik-2-graylog/5988/5 "2020-05-12T12:00:49Z")

</div>

Yes, routing on hostname with TCP only works with TLS.

> **[Configuration of non http port without TLS](https://community.traefik.io/t/configuration-of-non-http-port-without-tls/5901/2)**
>
> For TCP without TLS you must use HostSNI(\`\*\`) See HostSNI & TLS For TCP+TLS and HTTPS the SNI is levereaged. For HTTP the Host Header. For plain ol' TCP neither are available.