Announcing Graylog 7.2.0-beta.1

This is a beta release that improves Graylog’s functionality. Please read on for information on what has changed.

Downloads

Release date: 2026-08-31

Upgrade notes
DEB and RPM packages are available in our repositories
Docker Compose
Container images:
Tarballs for manual installation:

Graylog Server Changelog 7.2.0-beta.1

Release date: 2026-08-31

Added

Add optional store_full_message field to AWS Kinesis/CloudWatch input. graylog-plugin-enterprise#14362 graylog2-server#26820
Add HTTP Async proxy support for AWS Kinesis/Cloudwatch input. graylog2-server#14460 graylog2-server#26404
The AWS Kinesis/CloudWatch input’s Kinesis Client Library (KCL) is moving toward a single DynamoDB table for its coordination state instead of three. A new “Single DynamoDB table state tracking” option lets you migrate an existing input to that layout on your own schedule, via a one-way merge into its lease table. graylog-plugin-enterprise#14774 graylog2-server#26672
Added indicator for sync status of collectors. graylog2-server#25341 graylog2-server#26295
Add routing and performance columns to entity tables (inputs, streams, event definitions). graylog2-server#25930 graylog2-server#25997 graylog2-server#26072 graylog2-server#25981 graylog2-server#25951 graylog-plugin-enterprise#14265 graylog-plugin-enterprise#14277
Add support for relative, keyword, and absolute time ranges in entity data table filters. graylog2-server#26129 graylog2-server#26125
Add date_diff pipeline function to compute the difference between two date objects. graylog2-server#26142 graylog2-server#26143
Add endpoint for rotating multiple index sets graylog2-server#26807 graylog2-server#26802
Accept Search Query and Time Range as URL Parameters for Dashboards graylog2-server#8143 graylog2-server#26034
Display configuration warnings in data node detail page and in the support bundle graylog2-server#25857
Add reindexing for outdated indices (created in previous major version of OpenSearch) graylog-plugin-enterprise#14011 graylog2-server#25860
Combining the stream and category selection into one dropdown. graylog2-server#25893 graylog-plugin-enterprise#14154
Added support for multiple OpenSearch versions in DataNode graylog-plugin-enterprise#14156 graylog2-server#25895
Ability to assign tags to event definitions. graylog2-server#25896 graylog2-server#25940 graylog2-server#26079 graylog2-server#26841 graylog2-server#27145
Implement sampling for pipeline rule debug metrics. graylog2-server#25953 graylog-plugin-enterprise#14196
Implement pipelines processing-load endpoint. graylog-plugin-enterprise#14144 graylog2-server#26024
Added support for providing an External ID when assuming AWS IAM roles for the CloudTrail and Kinesis/CloudWatch inputs. graylog2-server#26077
Data node’s OpenSearch upgrade UI graylog-plugin-enterprise#14262 graylog2-server#26097
Add Sankey visualization for pivot configurations with multiple grouping fields. graylog-plugin-enterprise#7230 graylog2-server#26153
Include pipeline processing-load snapshot in support bundles. graylog-plugin-enterprise#14145 graylog2-server#26161
Add Network Graph aggregation visualization for exploring relationships between grouped fields. graylog2-server#26184
Make Sidecar default collector paths and host variable configurable. graylog2-server#26199
Added Collector onboarding UI. graylog2-server#26240
Adding the suggestions/query validation features from the regular search input to the query input in the event definition dialog. graylog2-server#26243
Enable Collectors in Graylog Cloud. graylog2-server#26261
Added a new event definition type filter and column on the main Event Definitions page. graylog-plugin-enterprise#11986 graylog2-server#26279
Add rolling restart feature and endpoint for data nodes’ OpenSearch. graylog2-server#26358
Allow entering arbitrary field names for groupings and metrics in the aggregation wizard. graylog2-server#26422
Add support for validating MCP tool call arguments. Upgrade io.modelcontextprotocol.sdk dependency to version 2.0.0 graylog2-server#26526
Add macOS Unified Logging Collector source graylog2-server#26542
Add Default, Routing, and Performance view buttons to the streams table for quickly switching between predefined column sets. graylog2-server#26555 graylog-plugin-enterprise#14711
Periodically truncate fleet transaction log. graylog2-server#26267 graylog2-server#26658
Add number of indices incompatible with the next major OpenSearch version to telemetry data. graylog-plugin-enterprise#14607 graylog2-server#26764
Added Collector onboarding page graylog2-server#26839
Expose Collector health in the user interface. graylog2-server#26800 graylog2-server#26840
Added datanode configuration opensearch_heap_size_warning_enabled to control heap size check and warnings graylog-plugin-enterprise#12164 graylog2-server#26952
Add metrics widgets (message, alert, and event counts, plus top sources) to the welcome page. The underlying queries can be disabled cluster-wide under System → Configurations → Welcome Page for users concerned about performance. graylog2-server#26961
Show OpenSearch nodes in cluster configuration page graylog-plugin-enterprise#15012 graylog2-server#26963
Added UI permission checks to collector pages graylog2-server#27157

Changed

Redirect to the content pack details page after a content pack is uploaded successfully. graylog2-server#23797 graylog2-server#15802 graylog2-server#23431 graylog2-server#26754
Changed dashboard widget drill-down popovers to show all metrics related to a chart click before offering value actions. graylog2-server#24220 graylog2-server#27099
Sets opensearch config bootstrap.memory_lock in datanode, disabled by default graylog2-server#25589 graylog2-server#25655
Increase default Collector expiration threshold to 90 days. graylog2-server#26044 graylog2-server#26740
Improving write amplification in current cluster event bus implementation. graylog2-server#24382
Added fallback name path.repo to the supported path_repo configuration option in datanode graylog2-server#25116 graylog2-server#25499
Support bundle improvements and fixes – parallelism, memory consumption, resource and error handling graylog-plugin-enterprise#13625 graylog2-server#25555
Indices directory parser optimizations and parallelism for faster and more reliable preflight checks in datanode graylog2-server#25638
Reduced the frequency of the OpenSearch data directory compatibility preflight check to trigger only on major version upgrades, skipping it for minor and patch releases. graylog2-server#25688
Allow collectors to re-enroll with their existing keypair. graylog2-server#25717 graylog2-server#25783
Sorting and searching on paginated tables in the product changes from case-sensitive to case-insensitive. graylog2-server#25808
Remove unused datanode controllers related to remote-reindex migration graylog2-server#25823
Generate stable operation IDs in OpenAPI description. graylog2-server#25862 graylog-plugin-enterprise#14125
Rank dropdown options by match quality so the best prefix matches appear at the top of typeahead suggestions. graylog2-server#26170
Data Lake restores that don’t incur license traffic now report gl2_accounted_message_size as 0. graylog2-server#26190
Improve Number visualization layout visually, increasing trend visibility. graylog2-server#26340
Renamed the “Fields” tab on the Event Definition wizard to “Additional Details”. graylog-plugin-enterprise#14222 graylog2-server#26355
Integrate OpenSearch upgrade step into the DataNode rolling restart process graylog2-server#26486
Simplify entity data table header interactions: drag the whole header to reorder columns, resize from the column border, and reveal header actions on hover. graylog2-server#26760
Stream titles in the streams overview no longer include the description text underneath; descriptions are shown in their own column again. graylog2-server#26826
Use new illuminate mapping for collector fields. graylog2-server#27159

Fixed

Apply static fields configured on a Forwarder input to forwarded messages. graylog-plugin-enterprise#13676
Fix Geo-Location Processor configuration failing to save when cloud storage is set to S3 or GCS. graylog2-server#14449 graylog2-server#26329
Keep the share settings of an event definition populated when navigating between wizard steps. graylog-plugin-enterprise#14480 graylog2-server#26990
Add entity-level permission check to event notification test endpoint. graylog-plugin-enterprise#14753 graylog2-server#26614
Fixed editing, excluding and removing search filters in event definitions when the filter is not saved in “My Filters”. graylog-plugin-enterprise#14990 graylog2-server#26866 graylog-plugin-enterprise#15088
Fix timerange validation not running when loading a saved search. graylog2-server#15957 graylog2-server#25585
Sort streams alphabetically in the “Test against stream” dropdown and make the dropdown searchable. graylog2-server#18694 graylog2-server#25849
Fix overlapping content in pinned columns of aggregation table widgets. graylog2-server#23712 graylog2-server#25656
Fix MCP tool output schemas that did not match the actual serialized output (DateTime and plain Object values were declared as objects, nullable fields as non-nullable), which made schema-validating MCP clients reject all search_messages, aggregate_messages, and list_fields responses. graylog2-server#23980 graylog2-server#25314 graylog2-server#26402 graylog2-server#26556
Fixed a bug where the Data Node version mismatch notification was never automatically cleared after all Data Nodes returned to a matching version graylog2-server#24718 graylog2-server#25879
Fix issue when inline search bound in Query Input. graylog2-server#25570 graylog2-server#25686
Improve input startup failure messages on the Input Diagnosis page with actionable details including bind address, port, and exception-specific guidance. graylog2-server#25416 graylog2-server#25663
Add validation to OpenTelemetry-gRPC input TLS config. graylog2-server#25417 graylog2-server#25419 graylog2-server#25764
Show loading indicator in event definition filter preview during in-flight queries instead of briefly displaying “no matches found”. graylog2-server#25431 graylog2-server#25444
Fix inconsistent collector instance counts (online exceeding total) while collectors are enrolling. graylog2-server#25648 graylog2-server#26109
Pipeline interpreter no longer silently replaces a valid pipeline state with an empty one when a transient MongoDB error occurs during reload. graylog2-server#25750
Add sort and filter support to Event Definitions Status column. graylog2-server#25926 graylog2-server#26063
Fix extractors being deleted when an input is started, stopped, or updated. graylog2-server#26009 graylog2-server#26198
Fix false Message failed to process errors when a pipeline rule or extractor assigns a string timestamp field in ISO-8601 format. Such timestamps are now parsed leniently instead of being recorded as a processing failure. graylog2-server#26025 graylog2-server#26269
Exclude collector system logs from traffic accounting. graylog2-server#26036 graylog2-server#26190
Fix duplicate metric registration error during concurrent pipeline state builds graylog2-server#26080
Fix timeout settings for async optimize index jobs graylog2-server#26090 graylog2-server#26183
Fixed extractor listing breaking with a 500 error when a lookup table extractor references a lookup table that was deleted. Such extractors can now be listed, edited and deleted again. graylog2-server#26122 graylog2-server#26289
Fixed a startup failure on hosts where the Graylog data directory is on a noexec filesystem, caused by the node CPU-load metric eagerly loading the OSHI/JNA native library during boot. The metric now initializes lazily and degrades gracefully instead of preventing the server from starting. graylog2-server#26471
Navbar links and buttons no longer keep the focus ring visible after a mouse click; the outline now only shows for keyboard navigation. graylog2-server#26503 graylog2-server#26504
Fixed the columns dropdown not closing after clicking “Reset all columns”. graylog2-server#26537 graylog2-server#27117
Fix PostHog session recording not starting after telemetry opt-in. graylog2-server#26670 graylog2-server#26671
Skip CEF fields that carry an empty numeric value instead of logging a stack trace for each message. graylog2-server#26833 graylog2-server#26835
Fix MCP ping request returning an internal error (-32603) instead of an empty result. graylog2-server#27066 graylog2-server#27123
Fix tool failure related to NPE when retrieving stream descriptions graylog2-server#25214 graylog2-server#25217
Fix stale stream title in Data Lake preview after rename graylog-plugin-enterprise#11967 graylog2-server#25686
Render Alerts & Events histogram in the user’s configured timezone so its x-axis matches the events table below. graylog2-server#25744
Fix More button is misaligned in Entity Data Table Action column. graylog2-server#25565 graylog2-server#25747
Enforce clusterconfiguration:read permission on Cluster Configuration API endpoints graylog2-server#25754
Fix bright flashes on page reload when using the dark-mode theme. graylog2-server#25766
Fixed a ClassCastException in inputs service that caused cluster_stats to appear as an error string in the support bundle’s cluster.json. graylog2-server#25781
Validate index field type profiles when saving and updating them. graylog2-server#25792
Surface partial shard failures from searches instead of silently returning incomplete results. graylog2-server#25797
Encrypt secret fields for AWS Kinesis/Cloudwatch and TCP-based inputs. graylog2-server#25800
Add startup warning for mismatched password fields, and mask additional encrypted input fields. graylog2-server#25801
Remove ‘query’ part duplication in indexer query for events. graylog2-server#25807
Fix serializing message body for details in error processing stream. graylog2-server#25906
Fix broken Manage extractors link for local inputs on the Inputs overview page. graylog2-server#25907
Fix initial loading of message and simulation response in the pipeline simulator. graylog2-server#25915
Fix missing X-Requested-By header on API browser try-it-out requests, which caused CSRF rejections. graylog2-server#25931 graylog2-server#25933
Fix system notification polling extending user sessions. graylog2-server#25995 graylog2-server#25996
Fix replayed search not refreshing when selecting a different event on the Bulk Replay Search page. graylog-plugin-enterprise#14234 graylog2-server#25999
Fix MCP server 500 error on unknown client capability fields graylog2-server#25956 graylog2-server#26008
Fix event definition procedure in sidebar when security license is absent. graylog-plugin-enterprise#14259 graylog2-server#26026
Fix uneven bar widths on stacked time-bucket charts where some series only contain data for a single timestamp. graylog2-server#11676 graylog2-server#26030
Provide certificate authentication for internal OpenSearch maintenance calls. graylog-plugin-enterprise#14009 graylog2-server#26076
Add missing redirect to new API browser. graylog2-server#26093
Upgrade openapi-explorer to fix schema parsing bugs in the REST API browser. graylog2-server#26105
Provide endpoint for deletion of non-Graylog managed outdated indices. graylog2-server#26106
Add safeguards for beats protocol frame parsing. graylog2-server#26139
Fix NPE when retrieving fields for indices whose mappings have no properties block (e.g. system indices) graylog2-server#26140
Carry search filters into widget replay search so the replayed search matches what the widget displayed. graylog-plugin-enterprise#8869 graylog2-server#26151
Relax shard failure checking in CustomOpenSearchClient: only bail out when all shards fail, so searches with partial shard failures still return their available results. graylog2-server#26156
fix potential null messages in events after event summary template transformation. graylog2-server#26188
Fix Sidecar config not being loaded from the Graylog server configuration file. graylog2-server#26200
Fix Inputs Metrics telemetry not being reported. graylog2-server#26244
Replaying a dashboard widget again opens the replayed search in a new browser tab, keeping the dashboard open. graylog2-server#26268
Fix Inputs page: Error occurs after creation External Data Lake Input. graylog2-server#13830 graylog2-server#26292
Fixed broken GreyNoise Quick IP Data Adapter by migrating to v3 API endpoint. graylog2-server#26296
Fix Inputs: Show green badges for pull inputs when running on all expected nodes. graylog-plugin-enterprise#13977 graylog2-server#26314
Fix lexicographic sorting of pivots on numeric grouping fields with non-long/double/float or mixed-but-numeric types. graylog2-server#26326
Run cert provisioning even for explicitly configured datanodes. graylog2-server#26332
Fixed missing inclusion of stream categories in preview query in event definition creation dialogs. graylog2-server#26367
Fix deprecated @Valid on List container in AggregationRequestSpec graylog-plugin-enterprise#14515 graylog2-server#26400
Hide the create dashboard button for users without the dashboards:create permission. graylog2-server#26448
Fixed missing rate metrics in Data Node Dashboard. graylog-plugin-enterprise#14568 graylog2-server#26456
Fix fleet filter on the Collector instances table. graylog2-server#26485
Propagate scope when resolving referenced search filters during content pack installation. graylog2-server#26508
Fixed OpenSearch metrics datastream creation failures not being retried. graylog2-server#26558
Make data node heap warning container memory aware (contributed by gprossliner). graylog2-server#26554 graylog2-server#26568
Accept collector ingest mTLS connections only from certificates that are bound to an active collector instance. graylog2-server#26572
Fix content pack installation failing when it references a stream that cannot be resolved on the target system (for example “Missing Stream for widget entity” or “Stream with title <…> does not exist”). Such unresolvable stream references are now skipped with a warning instead of aborting the whole installation. graylog-plugin-enterprise#12987 graylog2-server#26581
Fix setting compression in OpenSearch client when enabled using elasticsearch_compression_enabled. graylog2-server#26633
Fix security demo pages not rendering when Graylog is deployed with a path prefix. graylog2-server#26645
Fix problem in GET /messages/{index}/{messageId}. Permission requirements introduced by previous security fix have been too strong, they have been relaxed. graylog2-server#26657
Fix Kafka inputs being unable to process LZ4-compressed record batches. graylog2-server#26674
Prefer hostname in opensearch sniffer graylog2-server#26743 graylog2-server#26744
Fixed a visual glitch when dragging a column with a dot in its id in the entity data table; the column order still changed correctly, but the drag animation was broken. graylog2-server#26762
Truncate certificate CN to RFC 5280’s 64-character limit to prevent certificate generation from failing on hosts with long hostnames. graylog2-server#26786
Fixed Enterprise MongoDB Data Adapter CIDR entries being cached up to one hour after their TTL had expired. graylog2-server#26854
Added needed input create permissions checks for the AWS CloudWatch and Kinesis input API endpoints. graylog2-server#26878
Fix running the file_log receiver on Windows. collector#90 graylog2-server#26916
Show the Outputs and Pipelines count columns for the default stream in the Streams overview. graylog-plugin-enterprise#14572 graylog2-server#26971
Fixed the Streams page showing “Archiving is enabled” for streams that are excluded from archiving under Archive > Configuration > Streams to archive. graylog-plugin-enterprise#14996 graylog2-server#26974
Prevent a crash on the event definition Notifications step when a notification is assigned without selecting one. graylog2-server#27026
Properly escaping space in lucene queries on search page/event definitions/internal functionality. graylog2-server#27029
Fixed bulk indexing requests being dropped instead of retried when OpenSearch returns an incomplete response during shard reallocation. graylog2-server#26853 graylog2-server#27031
Fixed enabling MongoDB profiling from the Graylog UI failing with a permission error on MongoDB 8.0.29 and later. graylog-plugin-enterprise#15257 graylog2-server#27039
Fixed a crash when displaying values which contain integers exceeding the safe integer range, e.g. in the pipeline rule simulator output. graylog2-server#27058

Security

Fix path traversal in the web interface and preflight asset resources graylog2-server#26942
Fix FortiGate syslog parser handling of quoted values. GHSA-gqr6-r77p-c2pj
Fix IDOR in access-token revocation endpoint. See GHSA-j769-9gv9-65gr for details.
Fix NetFlow V9 loop with unreachable exit condition. graylog-plugin-enterprise#15330 graylog2-server#27127
Enforce per-entity read permission on the event definition duplicate endpoint, preventing users from cloning event definitions they have not been granted access to. graylog2-server#26590 graylog2-server#26706
Update netty to 4.2.13, addressing multiple advisories graylog2-server#25972
Check display field read permissions when resolving entity titles. graylog2-server#26284
Validate ownership for share requests when updating view (search/dashboard). graylog2-server#26344
Upgrade OpenSearch bundled log4j dependencies from 2.25.3 to 2.25.4 in Data Node. graylog-plugin-enterprise#14512 graylog2-server#26396
Protect regex tester REST endpoints against ReDoS by enforcing input length limits and a per-match timeout. graylog2-server#26483
Prevent ReDoS in entity suggestion search by quoting user-supplied query so it’s treated exactly as a plain-text substring rather than a regular expression graylog2-server#26540
Fix security issue in MessageResource that allowed fetching a message from an index the user has no read permission for. Prevent this kind of users to check index existence. graylog2-server#26565
Update to Netty 4.2.16 to fix several CVEs. graylog2-server#26603
Fix bug in updating a view where the check for permissions could test on a wrong view ID. graylog2-server#26715
Fix path traversal in datanode proxy resources. graylog-plugin-enterprise#15029 graylog2-server#26825
Prevent users from assigning permissions or roles they do not hold themselves when creating or updating a user. graylog2-server#26883
Fix IPFIX loop with unreachable exit condition. graylog-plugin-enterprise#15003 graylog2-server#26910
Prevent users from granting permissions they do not hold themselves through the roles endpoints. graylog2-server#26914
Check read permission for the requested lookup table in the lookup table tester endpoints. graylog2-server#26915
Fix thread usage issue for Palo Alto Panorama Syslog payload. graylog-plugin-enterprise#14949 graylog2-server#26960

Graylog Enterprise Changelog 7.2.0-beta.1

Added

Added SIEM log type to Mimecast V2 Input graylog-plugin-enterprise#11379 graylog-plugin-enterprise#14470
Added support for providing an External ID when assuming AWS IAM roles for the S3/Security Lake inputs, S3 archive, and Data Lake. graylog-plugin-enterprise#13603 graylog-plugin-enterprise#14280
Add predefined layout switching to the Alerts page, allowing users to quickly change between all, investigations, assets, alerts and system alerts table views. graylog-plugin-enterprise#14080 graylog-plugin-enterprise#14126 graylog2-server#25891 graylog-plugin-enterprise#14100 graylog-plugin-enterprise#14127 graylog-plugin-enterprise#14147 graylog-plugin-enterprise#14188 graylog-plugin-enterprise#14299 graylog-plugin-enterprise#14417 graylog-plugin-enterprise#14500 graylog2-server#25839 graylog2-server#25858 graylog2-server#25889 graylog2-server#25892 graylog2-server#25947 graylog2-server#26271
Add optional full_message field to Mimecast V2 Input. graylog-plugin-enterprise#14082 graylog-plugin-enterprise#14083
Allow users to view, edit, and delete Sigma-based event definitions directly from the Event Definitions page. graylog-plugin-enterprise#14351
Added Data Lake configuration settings to opt out of the manifest-rewrite and orphan-file-deletion steps of the automatic optimization job. graylog-plugin-enterprise#14371 graylog-plugin-enterprise#15299
Added a lock icon and restricted actions to differentiate scoped search filters from regular ones, and the load filter picker now hides immutable-scoped filters when the parent entity is immutable. graylog-plugin-enterprise#14550 graylog-plugin-enterprise#14994 graylog2-server#26816
Provide effective search query in locations where search filters are supported. graylog-plugin-enterprise#14552
Add scope enforcement to saved search filters, limiting the ability to modify Illuminate delivered filters. graylog-plugin-enterprise#14575 graylog-plugin-enterprise#14574 graylog-plugin-enterprise#14647
Add Kafka output for Enterprise graylog-plugin-enterprise#14617 graylog-plugin-enterprise#14699
Fixed RCF Anomaly Event Definitions not handling catch-up windows correctly, potentially resulting in false anomalies. graylog-plugin-enterprise#14669 graylog-plugin-enterprise#14671
Warm tier repositories can now be managed on a dedicated page under System > Indices. graylog-plugin-enterprise#15145 graylog-plugin-enterprise#14922
Added a parse_domain() pipeline function that parses a hostname into its domain, subdomain, registered domain (the effective top-level domain plus one label), and top-level domain, using the public suffix list. graylog-plugin-enterprise#6493 graylog-plugin-enterprise#15335 graylog-plugin-enterprise#15352
Added Data Lake size metrics for active tables, exposing total file size, record count, data file count, and stream-level breakdowns. Reduced the number of Iceberg snapshots retained to improve storage efficiency. graylog-plugin-enterprise#14192 graylog-plugin-enterprise#13825
Added ability to filter Illuminate packs by those available with current license. graylog-plugin-enterprise#13952
Combining the stream and category selection into one dropdown. graylog2-server#25893 graylog-plugin-enterprise#14154
Implement sampling for Illuminate pipeline rule debug metrics. graylog2-server#25953 graylog-plugin-enterprise#14196
Show retrievable stream size (bytes, records, files) in the Data Lake overview chart, data lake table, stream detail page, and the streams table column picker. graylog-plugin-enterprise#14290
Added Sigma Repos navigation item to Alerts page graylog-plugin-enterprise#14049 graylog-plugin-enterprise#14317
Add enhanced Detection Chains capability. graylog-plugin-enterprise#14338 graylog-plugin-enterprise#14397 graylog-plugin-enterprise#14361 graylog-plugin-enterprise#14429 graylog-plugin-enterprise#14559 graylog-plugin-enterprise#14692 graylog-plugin-enterprise#14715 graylog-plugin-enterprise#14841 graylog-plugin-enterprise#14883 graylog-plugin-enterprise#15020 graylog-plugin-enterprise#15121 graylog-plugin-enterprise#15164 graylog-plugin-enterprise#15260
Message List Widget maximum line number in reports configurable in plugin configuration page. graylog-plugin-enterprise#13257 graylog-plugin-enterprise#14347
Resolve associated asset IDs to their asset names in visualizations. graylog-plugin-enterprise#14586
Adding the suggestions/query validation features from the regular search input to the query input in the anomaly detection event definition dialog. graylog-plugin-enterprise#14590
Group the Data Lake and Failure Count columns into the streams table’s Routing and Performance views, and rename the “Retrievable Stream Size” column to “Data Lake Size”. graylog-plugin-enterprise#14711 graylog2-server#26555
Added new Watchlist functionality: CIDR range support for IPs, entry TTLs, entry caching, new Watchlist parameter type, and a dedicated UI for Watchlist management. graylog-plugin-enterprise#14913 graylog-plugin-enterprise#15109 graylog-plugin-enterprise#15188 graylog2-server#26525 graylog2-server#26694
Archives can now be built from OpenSearch snapshots instead of scroll queries. graylog-plugin-enterprise#14679
Added health reporter for search cluster quorum. graylog2-server#26810 graylog-plugin-enterprise#15041
Adds a health reporter that emits a warning if one or more data nodes are running with the copmatibility OpenSearch version. graylog-plugin-enterprise#15096
Added a cluster-config setting to optionally switch AD/LDAP synced-team membership reconciliation to a faster per-user mode. This trades speed of group reconciliation for login speed. graylog-plugin-enterprise#15155 graylog2-server#26947

Changed

Add full backend test coverage for automatically creating investigations from asset risk score threshold events. graylog-plugin-enterprise#13221
Moved Sigma rule import and management to Event Definitions page. graylog-plugin-enterprise#14032 graylog-plugin-enterprise#14422 graylog-plugin-enterprise#14143 graylog-plugin-enterprise#14855 graylog2-server#26210
Improved the search filter bar: applied filters can now be collapsed behind a count badge, and each filter shows its full title and query string instead of being truncated. graylog-plugin-enterprise#14578 graylog-plugin-enterprise#14773
Cache initial Illuminate bundle instead of enabling it automatically. graylog-plugin-enterprise#14902

Removed

Removed workaround stringifying Okta Log Events ‘securityContext.userBehaviors’ field – new Okta SDK properly serializes the field as a list of objects. okta-sdk-java#1689 graylog-plugin-enterprise#14964

Fixed

Fixed deleted streams reappearing in the Data Lake overview after a restart. graylog-plugin-enterprise#11757 graylog-plugin-enterprise#14800
Appled proper start/end date filters for Mimecast V2 input Archive Search requests. graylog-plugin-enterprise#12352 graylog-plugin-enterprise#14083
Fixed broken GreyNoise Full IP Data Adapter by migrating to v3 API endpoint. graylog-plugin-enterprise#13016 graylog-plugin-enterprise#14440
Persist field-types of restored messages from Data Lake. graylog-plugin-enterprise#13562 graylog-plugin-enterprise#14121
Fixed visibility of Security > Assets page for users with asset:read permissions. graylog-plugin-enterprise#13655 graylog-plugin-enterprise#14018
Aligned Enterprise badges with the shared Open Source badge component to improve badge readability and consistency. graylog-plugin-enterprise#13683 graylog-plugin-enterprise#14069
When adding new evidence to an existing investigation it was put in a random place in the evidence list. It has been fixed, now evidence order is stable, based on the order of the evidence addition. graylog-plugin-enterprise#13731 graylog-plugin-enterprise#13962
Show an explanation message on the investigations dashboard when the query time range limit is set below the required 7 days instead of displaying errors. graylog-plugin-enterprise#13809 graylog-plugin-enterprise#14713
Disable the “Set as active” button for archived investigations to prevent accidentally setting an archived investigation as active. graylog-plugin-enterprise#13855 graylog-plugin-enterprise#14102
Fix permission handling for Investigation event bulk status updates. graylog-plugin-enterprise#13859 graylog-plugin-enterprise#13969
Traffic event definitions are no longer created without a license. graylog-plugin-enterprise#13871 graylog-plugin-enterprise#13963
Fixed issue when using CSV/DSV data adapter backed lookup tables when doing query parameter substitution. graylog-plugin-enterprise#13965 graylog-plugin-enterprise#13966
Fix license violation notifications being incorrectly triggered by queued or inactive licenses. graylog-plugin-enterprise#14024
Fixed issue causing aggregation security event risk scores to be reported as zero when source log messages did not include an alert_severity_level field. graylog-plugin-enterprise#14103 graylog-plugin-enterprise#14146
Add retry with exponential backoff for warm-tier snapshot deletion to prevent orphaned snapshots on transient failures. graylog-plugin-enterprise#14118
Fixed parsing issue with Okta Log Events input. graylog-plugin-enterprise#14202 graylog-plugin-enterprise#14293
Fixed issue causing enabled Illuminate event definitions to be disabled after an Illuminate upgrade. graylog-plugin-enterprise#14231 graylog-plugin-enterprise#14236 graylog-plugin-enterprise#14267
Fixed invalid Detection Chain label/error on Security events after an Illuminate bundle install on a multi-node cluster. graylog-plugin-enterprise#14239 graylog-plugin-enterprise#14204 graylog-plugin-enterprise#14245
Fixed user-added asset priorities and categories from being overwritten after syncing assets from external source. graylog-plugin-enterprise#14405 graylog-plugin-enterprise#14410
Drop unsupported Sigma rules when a Git repository is synced. Existing repos will need to be refreshed to drop unsupported rules. graylog-plugin-enterprise#14501
Fixed the Sigma rules Git repository form incorrectly clearing the branch field and encrypted access token, not disabling its fields while submitting, and not validating/normalizing the Git URI and rule directories. graylog-plugin-enterprise#14521 graylog-plugin-enterprise#14940
Fixed LDAP team sync failing with “size limit exceeded” on large directories by paging the member-resolver query and restricting it to the configured user population. graylog-plugin-enterprise#14560 graylog-plugin-enterprise#14678
Fixed “bundle already enabled” error when enabling packs on air-gapped Illuminate installations. graylog-plugin-enterprise#14595 graylog-plugin-enterprise#14610 graylog-plugin-enterprise#14807
Fixed TCP output leaking connections under backpressure. graylog-plugin-enterprise#14614 graylog-plugin-enterprise#14776
Fixed display issues in the Streams overview table: the Data Lake size column is now blank when Data Lake is not enabled, failure counts are highlighted as a red link, and processing time columns no longer show a misleading 0 ms for streams with no recent traffic. graylog-plugin-enterprise#14639 graylog-plugin-enterprise#15016 graylog2-server#26811
Fixed Sigma rule query generation for plain values. Values are now quoted instead of being turned into regular expressions, which never matched analyzed fields like message for multi word or mixed case values. Rules using a keywords detection were affected the most, since those search across all fields. graylog-plugin-enterprise#14662
Fixed S3 archive restore jobs incorrectly reporting some failed jobs as successful. graylog-plugin-enterprise#14674 graylog-plugin-enterprise#14697
Validate S3 archive backend access on create and update. graylog-plugin-enterprise#14706 graylog-plugin-enterprise#14730
Fixed duplicate assets being displayed in asset list while paging with default sort. graylog-plugin-enterprise#14716 graylog-plugin-enterprise#14717
Fix Data Lake S3 backend not assuming the configured IAM role when writing to the Data Lake. graylog-plugin-enterprise#14719
Fixed archive restore leaving an incomplete index behind when a restore fails or is cancelled. The partial index is now deleted automatically so the restore can be retried without manual cleanup. graylog-plugin-enterprise#14721 graylog-plugin-enterprise#14775
Hide the ‘Send Notifications’ security event action when no valid Security license is present. graylog-plugin-enterprise#14765 graylog-plugin-enterprise#14805
Reset the bulk selection once a bulk action completed on the Sigma repositories and Alerts & Events pages. Entities which are gone from the page are no longer counted by the bulk actions button, and no longer silently included in the next bulk action. graylog-plugin-enterprise#14789 graylog-plugin-enterprise#14182 graylog-plugin-enterprise#15219
Improve LDAP/AD login performance by making the group sync during login more efficient. graylog-plugin-enterprise#14822 graylog-plugin-enterprise#14909
Fixed archive job progress not displaying on multi-node deployments by polling the cluster-wide jobs endpoint instead of the per-node one. graylog-plugin-enterprise#14842 graylog-plugin-enterprise#14951
Fixed a resource leak when validating or saving Data Lake cloud backends. S3 backends using an assume-role ARN, and all GCS backends, previously leaked an HTTP connection pool on every validation attempt. graylog-plugin-enterprise#14997
Match asset hostnames, usernames, and email addresses case-insensitively, so log data associates with synced assets regardless of casing. graylog-plugin-enterprise#15116
Fixed constant reloading of associated asset panel on view individual message page. graylog-plugin-enterprise#15277 graylog-plugin-enterprise#15293
Add ‘Create extractor’ funtionality to log view widgets graylog-plugin-enterprise#2103 graylog-plugin-enterprise#13022
Automatically trim leading and trailing whitespace in asset category and priority values. graylog-plugin-enterprise#9645
Fixes slow or missing response in Create Index for Archives with large number of indices. graylog-plugin-enterprise#9993 graylog-plugin-enterprise#14148 graylog2-server#25890
Feeds configuration for welcome page can not be saved on clean installs. graylog-plugin-enterprise#13964 graylog-plugin-enterprise#13984
Fix Collections Error across application without license on enterprise. graylog-plugin-enterprise#13870 graylog-plugin-enterprise#14008
Fixed slow loading of the Illuminate > Customization page. graylog-plugin-enterprise#14014
Fix issue where the link between event procedures and actions could be broken during an Illuminate upgrade. graylog-plugin-enterprise#13994 graylog-plugin-enterprise#14016 graylog2-server#25799
Encrypt the Forwarder Service input’s TLS private key password. graylog-plugin-enterprise#14017
In slice-by, only show asset slices where the asset still exists in the asset database instead of the raw data. graylog-plugin-enterprise#14022 graylog-plugin-enterprise#14025
Fix archive jobs stuck in infinite retry loop when scroll and count APIs disagree on document count. graylog2-server#22904 graylog-plugin-enterprise#14104
Ensure general AI services (e.g. widget summaries) remain available when investigation summaries are disabled. graylog-plugin-enterprise#14140
Fixes NPE in error creation when Watchlist lookup table does not exist. graylog-plugin-enterprise#14168
Add workaround for exception being thrown on Okta input parsing due to upstream bug. okta-sdk-java#1689 graylog-plugin-enterprise#14199
Fix crash when clicking on investigation timeline events whose message contains regex special characters. graylog-plugin-enterprise#14229 graylog-plugin-enterprise#14230
Fix empty event replay sidebar after the Security license is removed. graylog-plugin-enterprise#13755 graylog-plugin-enterprise#14269
Fix security event Details actions row overflowing into adjacent columns at narrow widths by wrapping the owner/status controls onto a second line. graylog-plugin-enterprise#14325 graylog-plugin-enterprise#14330
Fixed issue preventing some tactic/technique values from being displayed in the filter select list. graylog-plugin-enterprise#14363 graylog-plugin-enterprise#14503
Resolve asset names for single values in AssetsField so single asset IDs no longer show as raw IDs in aggregation widgets. graylog-plugin-enterprise#14541
Fix Data Lake: Filters not working on internal lake overview page. graylog-plugin-enterprise#14193 graylog-plugin-enterprise#14615
Fix crash on Licenses page when cluster ID is unavailable. graylog-plugin-enterprise#14225 graylog-plugin-enterprise#14616
Fix Licenses and System Overview pages: Frontend spams server with license and traffic requests when no license is present. graylog-plugin-enterprise#14314 graylog-plugin-enterprise#14633
Fixed the public notifications endpoint being polled continuously without a valid Enterprise license, which flooded the browser console and network with failed requests. graylog-plugin-enterprise#14635
Fixed Data Lake snapshot expiration on tables with large snapshot backlogs. Expiration now runs in batches that are committed one by one, so progress survives server restarts, and it runs before compaction so a backlogged table can always recover. The optimize job’s schedule is no longer reset on every server start, orphan file deletion is skipped until expiration has caught up and now runs as part of the scheduled optimization, and concurrent table metadata loads are limited to prevent OutOfMemory errors caused by oversized table metadata. graylog-plugin-enterprise#14788
Orphaned Iceberg tables of deleted streams now show up as “Deleted Stream” entries in the Data Lake overview, where they can be deleted and are subject to retention. graylog-plugin-enterprise#11757 graylog-plugin-enterprise#14862
Fix AD/LDAP team sync wrongly removing users who belong to a synced team only through a nested group, which caused intermittent “Missing Stream Permissions” errors. Membership is now resolved transitively per user from directory memberOf back-links, avoiding the AD MaxValRange (1500) member truncation and the slow per-user in-chain search, so both the reconcile and login stay fast on large directories. The group enumeration is also paged so directories with more than 1000 groups are no longer truncated. graylog-plugin-enterprise#15026 graylog-plugin-enterprise#15027 graylog-plugin-enterprise#15048 graylog-plugin-enterprise#15037
Added missing input create permission checks for Enterprise inputs. graylog-plugin-enterprise#15092
Fixed CIDR lookup table entries not expiring on other cluster nodes, where an entry with a TTL kept resolving after it was removed from the adapter. graylog-plugin-enterprise#15125
Fixed bulk category assignment carrying each asset’s existing categories over to every later asset in the same request. graylog-plugin-enterprise#15130
Fixed Illuminate content failing to download from the Illuminate Hub if only a Security license was installed. graylog-plugin-enterprise#15199
Fixed archive restore job state not propagating across nodes in a multi-node cluster. graylog-plugin-enterprise#15247
Fixed a crash on the Forwarder details page when the forwarder inputs were loaded before the available input types. graylog-plugin-enterprise#15280
Fixed Sigma rule query generation for queries turned into regular expressions with values containing double quotes. graylog2-server#26865 graylog-plugin-enterprise#15301

Security

Add a configurable disk usage high watermark (default 95%) to the filesystem archive backend. Archiving now fails with an error once the output path’s filesystem reaches the watermark, preventing unbounded archive creation from exhausting disk space. graylog-plugin-enterprise#10706

Please report bugs and any other issues in our GitHub issue tracker. Thank you!