Announcing Graylog 7.0.0-beta.1

This is a bug-fix release that improves Graylog’s functionality. Please read on for information on what has changed.

Downloads

Released: 2025-09-22

• Upgrade notes
• DEB and RPM packages are available in our repositories
• Docker Compose
• Container images:
  • Graylog Open
  • Graylog Enterprise
  • Graylog Data Node
• Tarballs for manual installation:
  • Graylog Server
  • Graylog Server (bundled JVM, linux-x64)
  • Graylog Server (bundled JVM, linux-aarch64)
  • Graylog Enterprise Server
  • Graylog Enterprise Server (bundled JVM, linux-x64)
  • Graylog Enterprise Server (bundled JVM, linux-aarch64)
  • Graylog Data Node (bundled JVM, linux-x64)
  • Graylog Data Node (bundled JVM, linux-aarch64)

Forwarder 7.0-beta.1

Release date: 2025-09-22

• Operating system packages:
  • DEB Package
  • RPM Package
• Docker Compose
• Container image:
  • Docker Hub
  • docker pull graylog/graylog-forwarder:7.0-beta.1-1
• Tarballs for manual installation:
  • Graylog Forwarder

Graylog Server Changelog 7.0.0-beta.1

Released: 2025-09-22

Added

• Add ability for HTTP notifications to retry requests for temporary HTTP failure codes. graylog2-server#11313 graylog2-server#23334
• Added the ability to include Remediation Steps in notification templates. graylog2-server#19864 graylog2-server#23421
• Implement buttons on search page to move search time range forward and backward. graylog2-server#20717 graylog2-server#22953
• Prevent nested key/value pair parsing in FortiGate Syslog messages. graylog2-server#22886
• Add optin to perform value actions from widget charts by clicking on charts data points. graylog2-server#23392 graylog2-server#23389
• Add option to create thresholds on widget charts. graylog2-server#23549 graylog2-server#23537
• Added option for multi-value lookups to CSV File data adapters. graylog2-server#4203 graylog2-server#23346 graylog2-server#23436
• Add option to select Security Overview page on startup with valid security license. graylog-plugin-enterprise#11539 graylog2-server#23582
• Data Node uses OpenSearch 2.19.3. graylog-plugin-enterprise#9665 graylog2-server#21537
• Add support for X-Forwarded-For/Forwarded/X-Real-IP type headers in HTTP inputs to better support proxied connections graylog2-server#22872
• Hide widget icons when not hovering over widget to avoid distractions. graylog2-server#22880
• Adding Text/Markdown widget to available search/dashboard widgets. graylog2-server#22882
• Adding pluggable ‘aside’ element (views.elements.aside) which can be used to show right sidebar on search/dashboard pages. graylog2-server#22942
• Adding optional description field to widgets. graylog2-server#22954
• Adding permission check to show only plugin configuration pages, that the user is allowed to see. graylog2-server#22979
• Added data preview feature for lookup tables with supported data adapters. graylog-plugin-enterprise#11114 graylog2-server#23046
• Explicit support for unencrypted client certificates in datanode graylog2-server#23171 graylog2-server#23182
• Change default visibility of Cluster Configuration page to users with new role Cluster Configuration Reader. graylog-plugin-enterprise#10605 graylog2-server#23248
• API browser is now only visible to users with the role “Admin” or “API Browser Reader”. graylog-plugin-enterprise#10625 graylog2-server#23318
• Added indexer_jwt_auth_token_clock_skew_tolerance configuration for datanode/opensearch auth graylog2-server#23355
• Added ability track which parent entity a dashboard was cloned from. graylog2-server#23434 graylog2-server#23593
• Adding conversion function to_list for pipeline rules. graylog2-server#23447
• Allow sharing Content Pack Entities after installation graylog2-server#23454
• Install opensearch plugin for HDFS snapshot repository in datanode graylog-plugin-enterprise#11706 graylog2-server#23507
• Add styles, components, and add fixed values to Select component. graylog2-server#23566
• Scroll to widget after leaving edit/focus mode. graylog2-server#23567
• Toggling to edit mode automatically after creating new widget. graylog2-server#10294 graylog2-server#23577
• Added the ability to include Event Procedures in Slack notifications. graylog2-server#11542 graylog2-server#23604
• Add support for custom preflight web password in server (preflight_web_password configuration option) graylog2-server#23607
• External data lake search and retrieval enabled in enterprise. graylog-plugin-enterprise#11933 graylog2-server#23688

Changed

• Switch to Java 21. graylog2-server#20015 graylog2-server#22908 graylog-plugin-enterprise#11084 graylog-project-internal#178
• Minimum required version of MongoDB is now raised to 7.0. graylog2-server#23448
• Lookup table improved creation workflow and UI graylog-plugin-enterprise#11092 graylog2-server#23056 graylog2-server#23203 graylog2-server#23222 graylog2-server#23262 graylog2-server#23273 graylog2-server#23017 graylog2-server#23376
• Make default settings for creating new tokens more secure. graylog2-server#21856 graylog2-server#23333
• Renamed all remaining occurrences of ‘Data Warehouse’ to ‘Data Lake’. graylog-plugin-enterprise#9752 graylog-plugin-enterprise#1804 graylog2-server#23558 e2e-tests#1285

Fixed

• Restore global overrides after canceling widget edit mode. graylog2-server#10681 graylog2-server#23608
• Fix scroll on click behaviour for scroll hint on search page. graylog2-server#19329 graylog2-server#22928
• Fix color of comments in pipeline rule editor. graylog2-server#19346 graylog2-server#23049
• Improve color of count badges in streams overview. graylog2-server#20746 graylog2-server#23211
• Rename whitelist to allowlist in UI, API, and codebase. graylog2-server#21034 graylog2-server#22903 graylog-plugin-enterprise#11590
• Improve structure of auto-correct suggestions in search query input. graylog2-server#21392 graylog2-server#22944
• Fixed broken filtering on Dashboards page. graylog2-server#21720 graylog2-server#23572
• Display field value suggestions in search query input, for values which include a dot, after mistyping. graylog2-server#21814 graylog2-server#23061
• Improve background color of selected text in search query input. graylog2-server#21900 graylog2-server#22964
• Fixing issue with message table pagination on search page, where the active page was not set correctly when opening pages very fast. graylog2-server#22321 graylog2-server#23013
• Display delete button completely in saved searches overview. graylog2-server#22781 graylog2-server#22929
• Fix Content Pack creation for pipeline rules, pipelines and streams with null descriptions. graylog2-server#22911 graylog2-server#23616
• Fixing issue with message table pagination on search page, where active page was not reset correctly when executing new search. graylog2-server#23002 graylog2-server#23013
• Display correct visualization for bar charts with logarithmic axis type graylog2-server#23031 graylog2-server#23032
• Fix Sidecar Administration Page Searchfield. graylog2-server#23106 graylog2-server#23358 graylog2-server#23385
• Add shared entities table type filters. graylog2-server#23115 graylog2-server#23362
• Fixed issue preventing expired searches from being cleaned up. graylog2-server#23172 graylog2-server#23173
• Ensure retained ByteBuf is released in SyslogTCPFramingRouterHandler on decode failure. graylog2-server#23312 graylog2-server#23317
• Support for password complexity rules. graylog2-server#5283 graylog2-server#23419
• Fix Teams Overview tab visibility for Team Inspector role graylog-plugin-enterprise#11568 graylog2-server#23599
• Fixing timerange calculation for ’to’ in DatePicker depending on ‘from:All time’ selection. graylog2-server#22430 graylog2-server#22839
• Fix editing a existing Event Definition not showing update button. graylog2-server#22916 graylog2-server#22918
• Fixed issue causing markdown content to erroneously escape quote characters. graylog-plugin-enterprise#11124 graylog2-server#22970
• Fixing issue where navigation dropdown menus were hidden behind the pinned search sidebar. graylog-plugin-enterprise#11200 graylog2-server#23014
• Disable opensearch node autodetection for statically configured list of opensearch hosts graylog2-server#23057 graylog2-server#23062
• Fixing issue with query validation popover for search filter form in event definition wizard. graylog-plugin-enterprise#11200 graylog2-server#23065
• Deduplicate opensearch node roles in datanode graylog2-server#22569 graylog2-server#23100
• Fixed issue for CloudTrail input which overwrote userIdentity fields for temporary credentials graylog2-server#22086 graylog2-server#23109
• Fix possible race condition when creating database collection for recent activity. graylog2-server#23092 graylog2-server#23111
• Extended path_repo conversion and validation in the data node configuration. graylog2-server#22478 graylog2-server#23116
• Improve dark mode colors for panel component. graylog-plugin-enterprise#10175 graylog2-server#23147
• Fix header styling of copy widget to dashboard modal. graylog2-server#23181
• Fix boolean condition on when to call query validation during search filter creation. graylog-plugin-enterprise#11303 graylog2-server#23187
• Improve color of status icon in streams and users overview, in dark mode. graylog2-server#20746 graylog2-server#23225
• Add java heap size validator to opensearch_heap property in datanode graylog2-server#23237 graylog2-server#23246
• Fix generated list of opensearch initial manager roles in datanode graylog2-server#23276
• Fix dependency check during sharing of event definitions. graylog-plugin-enterprise#11055 graylog2-server#23283
• Fix logging section just shows a loading spinner. graylog2-server#11431 graylog2-server#23291
• Connecting a pipeline to a stream requires edit permissions on the stream. graylog2-enterprise#10654 graylog2-server#23308
• Fix permissions for logs rotation in datanode/opensearch graylog2-server#23338 graylog2-server#23347
• Place new widgets at bottom of grid. graylog-plugin-enterprise#4233 graylog2-server#23487
• Fix issue with output edit button not opening edit modal after first click. graylog-plugin-enterprise#8432 graylog2-server#23505
• Fix exception on message permalink page before streams loaded. graylog2-server#23629
• Fixing race condition in recent message loader. graylog2-server#23632
• Fixed issue causing Event Notificaiton to be unusable after creation without global notifications permissions. graylog2-server#23677
• Optional description for input types to be shown in the input creation modal. graylog2-server#23698

Security

• Fix permission check for creating a new API-token. See GHSA-3m86-c9x3-vwm9 for details.
• Update Netty to 4.2.6 to fix GHSA-fghv-69vj-qj49 and GHSA-3p8m-j85q-pgmj. graylog2-server#23576

Graylog Enterprise Changelog 7.0.0-beta.1

Released: 2025-09-22

Added

• Added the ability to filter security events based on event definition type. graylog-plugin-enterprise#10097 graylog-plugin-enterprise#10593
• Added Asset Risk Score Threshold event definition. graylog-plugin-enterprise#11291 graylog-plugin-enterprise#111160 graylog2-server#23143 graylog2-server#23349 graylog-plugin-enterprise#11549
• Added Qualys as an Asset vulnerability import source. graylog-plugin-enterprise#11254 graylog-plugin-enterprise#11253 graylog-plugin-enterprise#11774 graylog-plugin-enterprise#11885
• Add input for AWS security lake filtered inputs. graylog-plugin-enterprise#11259 graylog-plugin-enterprise#11337
• Added Tenable Cloud as an Asset vulnerability import source. graylog-plugin-enterprise#11279 graylog-plugin-enterprise#11322 graylog-plugin-enterprise#11278 graylog-plugin-enterprise#11306 graylog-plugin-enterprise#11550 graylog-plugin-enterprise#11561
• Added ability to filter Dashboards and Event Definitions provided by Illuminate on the respective entity pages. graylog-plugin-enterprise#11526 graylog-plugin-enterprise#11716 graylog-plugin-enterprise#11813 graylog-plugin-enterprise#11907 graylog2-server#23574 graylog2-server#23660
• Added logic to switch between Alerts and Security Events page based on license in general perspective. graylog-plugin-enterprise#11537 graylog-plugin-enterprise#11613 graylog2-server#23396
• Added functionality to investigations drawer in general perspective. graylog-plugin-enterprise#11538 graylog-plugin-enterprise#11805
• Added the ability to include Event Procedures in notification templates. graylog-plugin-enterprise#11542 graylog2-server#19864 graylog-plugin-enterprise#11659
• Add Assume Role ARN configuration field for the AWS Security Lake input. graylog-plugin-enterprise#11663 graylog-plugin-enterprise#11685
• Add external data lake polling input graylog-plugin-enterprise#11704 graylog-plugin-enterprise#11890
• Added support for Hadoop Distributed File System (HDFS) in warm tier. graylog-plugin-enterprise#11706 graylog-plugin-enterprise#11754
• Show Default Collections from Team on Sharing Modals. graylog-plugin-enterprise#11747 graylog-plugin-enterprise#11778
• Added Automatic authentication to the AWS Security Lake Input. graylog-plugin-enterprise#11784
• Provide deletion external data lake retrievals and connectors including linked retrievals graylog-plugin-enterprise#11880 graylog-plugin-enterprise#11908
• Autofill external data lake input fields graylog-plugin-enterprise#11927 graylog-plugin-enterprise#11934
• Added support for multiple Illuminate-shipped streams to share a single index set. graylog-plugin-enterprise#2805 graylog-plugin-enterprise#11493
• Add entity collections. graylog-plugin-enterprise#11004
• Extend Bitdefender GravityZone input to suport Forwarded-For and Real-IP headers with trusted proxy checks graylog-plugin-enterprise#11072
• Added entity membership policies. graylog-plugin-enterprise#11094
• Add ability to record Asset History in OpenSearch. graylog-plugin-enterprise#11139 graylog-plugin-enterprise#11231 graylog-plugin-enterprise#11304 graylog-plugin-enterprise#11307 graylog-plugin-enterprise#11363 graylog-plugin-enterprise#11425 graylog-plugin-enterprise#11461
• Added Athena credentials management and connection provider graylog-plugin-enterprise#11237
• Add support for Athena data lake name, S3 bucket and stream ID graylog-plugin-enterprise#11328
• Added new 1Password Log Events input graylog-plugin-enterprise#11385
• Add support for Security Alerts V2 endpoint in the Microsoft Graph input. graylog-plugin-enterprise#11440
• Added Data Lake Retrievals Page. graylog-plugin-enterprise#11571 graylog-plugin-enterprise#11574 graylog-plugin-enterprise#11612
• Add sharing functionality to teams and team users graylog-plugin-enterprise#11446 graylog-plugin-enterprise#11667 graylog2-server#23439
• Allow sharing Illuminate pack entities/add to collections on installation/enabling. graylog-plugin-enterprise#11690
• Adds retrieval history for external data lake retrievals. graylog-plugin-enterprise#11710
• Show validation errors for field filters in data lake retrieval form. graylog-plugin-enterprise#11764
• Extend SAML authentication service configuration to restrict user groups that are allowed to log in. graylog-plugin-enterprise#11802
• Added ability to specify the Graylog Security Welcome Page as the default user start page. graylog-plugin-enterprise#11806
• Add user information to the data lake retrievals page graylog-plugin-enterprise#11831

Changed

• Renamed all remaining occurrences of ‘Data Warehouse’ to ‘Data Lake’. graylog-plugin-enterprise#9752 graylog-plugin-enterprise#11804 graylog2-server#23558 e2e-tests#1285
• Moving upload csv data adapter support from cloud into enterprise. graylog-plugin-enterprise#10547 graylog-plugin-enterprise#11435
• Changed to a read-only view of Illuminate Customization page if the user only has read permissions. graylog-plugin-enterprise#11811
• Connectors UI changes: add hyperlink stream title and remove index set form graylog-plugin-enterprise#11871 graylog-plugin-enterprise#11858 graylog-plugin-enterprise#11882

Fixed

• Fixing permissions error for reader users when opening reporting plugin section on system configurations page. graylog-plugin-enterprise#10399 graylog-plugin-enterprise#11097
• Fix broken link on data lake preview page, when running Graylog web interface with a path prefix. graylog-plugin-enterprise#10418 graylog-plugin-enterprise#11093
• Resolved an issue where reopening the replay search modal for security events continued to reference the previously replayed search. graylog-plugin-enterprise#10472 graylog-plugin-enterprise#11473
• Fix a problem with Data Lake Preview search jobs cancellation, where despite proper cancellation of the job, the system was reporting them as error jobs or still running jobs. Now they are properly identified as cancelled jobs. graylog-plugin-enterprise#10890 graylog-plugin-enterprise#11218
• Fix journal threshold handling in Data Lake and add warning notification graylog-plugin-enterprise#10893 graylog-plugin-enterprise#11355
• Fix forwarder profile delete response so that no error message is shown. graylog-plugin-enterprise#10944 graylog-plugin-enterprise#11454
• Fix usage of unicode as values in MongoDBDataAdapter. graylog-plugin-enterprise#11031 graylog-plugin-enterprise#11030
• Add support for general single document payloads for Azure Event Hubs input. graylog-plugin-enterprise#11179 graylog-plugin-enterprise#11555
• Event Procedure Library list and Step Library list modal now show more information about the entities listed. graylog-plugin-enterprise#11187 graylog-plugin-enterprise#11836
• Set ACTIVE license status also if license is violated. graylog-plugin-enterprise#11198 graylog-plugin-enterprise#11331
• Fix error when showing preview for ineligible widgets in ‘add widget’ drawer on report pages. graylog-plugin-enterprise#11199 graylog-plugin-enterprise#11257
• Removed ‘Replay Search’ links on investigation events when user is missing permissions to view results. graylog-plugin-enterprise#11210 graylog-plugin-enterprise#11403
• Fixed Event Procedures form, summary, title and plugin styling issues and behavior. graylog-plugin-enterprise#11270 graylog-plugin-enterprise#11029 graylog-plugin-enterprise#11841 graylog2-server#23559 graylog-plugin-enterprise#11807 graylog-plugin-enterprise#11891
• Fixed Sigma Rule events not showing associated event procedures. graylog-plugin-enterprise#11271 graylog-plugin-enterprise#11341
• Fixed error when trying to add search filters to Illuminate Sigma rules. graylog-plugin-enterprise#11361 graylog-plugin-enterprise#11362 graylog-plugin-enterprise#11396
• Fixed Asset source and vulnerability sync jobs continuing to run without a license present. graylog-plugin-enterprise#11430 graylog-plugin-enterprise#11564
• Removed unnecessary interruption handling around semaphore wait to ensure the Data Lake process flushes correctly on shutdown. graylog-plugin-enterprise#11445 graylog-plugin-enterprise#11637
• Improved performance and error handling for AWS Security Lake input. graylog-plugin-enterprise#11465 graylog-plugin-enterprise#11469 graylog-plugin-enterprise#11499
• Slightly change logic which generates color shades based on custom-defined color variants. graylog-plugin-enterprise#11515 graylog2-server#23326
• Fixing issue with Mimecast (v2.0 API) Input causing the ingestion of some logs to fail silently.. graylog-plugin-enterprise#11608 graylog-plugin-enterprise#11614
• Rename Connections feature to Connectors graylog-plugin-enterprise#11729 graylog-plugin-enterprise#11738
• Wording changes for Data Lake Connectors page graylog-plugin-enterprise#11737 graylog-plugin-enterprise#11777
• Refactor Data Lake > Setup path graylog-plugin-enterprise#11779 graylog-plugin-enterprise#11780
• Add show messages and delete buttons to Data Lake Retrievals graylog-plugin-enterprise#11852 graylog-plugin-enterprise#11881
• Ensure that font color of header badge in navigation has a good contrast in dark mode. graylog-plugin-enterprise#5137 graylog2-server#23219
• Fixed an issue where widget labels appeared incomplete in reports. The widget height is now determined using the original aspect ratio by default. Additionally, an option to manually adjust the widget height has been provided. graylog-plugin-enterprise#6684 graylog-plugin-enterprise#11479
• Fixed issue that allowed additional unknown JSON properties to be accepted (and ignored) in API requests on the Graylog leader node. graylog-plugin-enterprise#11085
• Fix Stream destination DataLake section toggle button disabled after enabling. graylog-plugin-enterprise#11142 graylog-plugin-enterprise#11143
• Adding permission check to view report plugin configuration page. graylog-plugin-enterprise#11183
• Added additional API error logging for the Microsoft Graph input graylog-plugin-enterprise#11238
• Default Asset Latitude and Longitude to null instead of 0. graylog-plugin-enterprise#11276
• Don’t flush non-existing data to iceberg. graylog-plugin-enterprise#10055 graylog-plugin-enterprise#11421
• In search filters overview, show all filters the user is allowed to see, not only the ones he owns. graylog-plugin-enterprise#10608 graylog-plugin-enterprise#11432
• Fixing that widgets from a saved search could not be exported to PDF by adding missing fields to the DTO. graylog-plugin-enterprise#11446 graylog-plugin-enterprise#11455
• Fixed override lookups of CIDR range Illuminate data adapters. graylog-plugin-enterprise#11495
• Fixed broken search link on Saved Search Event Procedure Steps with no query. graylog-plugin-enterprise#11609
• Fixed issue with automatic Illuminate bundle downloads that left orphaned bundle files in Mongo. graylog-plugin-enterprise#11783
• Improve error logging for the AWS S3 input. graylog-plugin-enterprise#11812
• Fix Datalake Setup Backend page not found graylog-plugin-enterprise#11839
• Fix custom mapping of user attributes for SAML authentication. graylog-plugin-enterprise#11859
• Fix duplicate grants error occurring on some Illuminate upgrades. graylog-plugin-enterprise#11863
• Retrieval result is stored in Mongo DB even if exception is thrown. In current version, the storage might have been omitted in case of exception. graylog-plugin-enterprise#11886

Graylog Forwarder Changelog 7.0-beta.1

Released: 2025-09-22

Changed

• Update Forwarder to run with Java 21. graylog2-server#20015 forwarder#175 graylog2-server#22908