Announcing Graylog v2.1.0-alpha.2

Today we are releasing the first alpha version of Graylog v2.1. Why alpha.2? We made improvements to alpha.1, before it was released. Every tag starts an automatic release and we are strictly following Semantic Versioning here at Graylog.

TESTING THE ALPHA

This Alpha release is not fully feature complete, but many important changes are ready to be tested, and we would definitely appreciate your help! Please submit issues at our GitHub graylog-server repository.

Below is the first changelog of this early release. We’ll be announcing more features and changes with each subsequent release.

DOWNLOAD

Graylog v2.1-alpha.2 can be downloaded from here.

Our virtual appliance in OVA format has also been updated for this release.

The operating system packages for v2.1-alpha.2 are available in our repositories. See our documentation for details.

Docker images are available on Docker Hub.

FEATURE HIGHLIGHTS

Here are some new features that we’d like to highlight. Make sure to test them and let us know about any issues you experience!

BEATS SUPPORT FOR COLLECTOR SIDECAR AND MESSAGE INPUT

The Graylog Collector Sidecar now supports Elastic Beats. This means you can control the deployment and configuration of your Beats fleet automatically and template-based from your Graylog Web Interface.

Pretty cool, eh? While nxlog has already been supported by the Collector Sidecar for Microsoft Windows log collection, we are adding more supported log collectors in future releases.

COLLECTOR STATUS DISPLAY IN WEB INTERFACE

Collectors can now send their internal status back to Graylog. A status page is listing all running collectors for each host and in case of an error, the host is marked with a small red badge to indicate the problem together with a message to get an idea why the collector is failing. Besides that the user can find general information on the status page like the tags that are configured for the Sidecar or a list of available log files. A real headless administration is now possible with these changes.

PIPELINE SIMULATOR

The Graylog Processing Pipelines feature that was introduced in v2.0 now comes with a complete simulator user interface that allows you to test your pipeline and rule compositions.

When a test or example log message is fed into the simulator, you will immediately see the following:

  • The resulting, fully processed and parsed log message
  • An overview of what fields were transformed and why
  • A microsecond resolution trace of the performed actions

We put a lot of work into this feature to make the parsing, transformation and enrichment of any log message as intuitive and easy as possible. We hope you will enjoy it and save a lot of time!

STREAM RULE DESCRIPTIONS AND ALERT CONDITION TITLES

Stream rules and alert conditions can now be annotated with more information. This is extremely useful when working in a team, where another team member might look at stream rules or alert conditions and needs some context about why they were created or what they are intended to do.

MORE CHANGES

PIPELINE PROCESSOR PLUGIN

COLLECTOR SIDECAR PLUGIN

  • Add support for Beats. Filebeat, Winlogbeat.
  • Beats binaries are bundled with the Collector-Sidecar package
  • Improve server side validation. Graylog2/graylog2-server#2247 and Graylog2/graylog-plugin-collector#7.
  • Add NXlog GELF TCP and TCP/TLS output
  • Add support to clone input, outputs and snippets
  • Optionally display collector status information in web interface
  • Optionally display log directory listing on status page
  • If no node-id is given use the hostname as identification
  • Linux distribution is detected and can be used in Snippet template
  • Silent install on Windows works now
  • Collector log files are now auto-rotated
  • Collector processes are supervised and restarted on crashes
  • NXlog Inputs and Outputs support free text configuration

WE LOVE YOUR FEEDBACK

We need feedback about what’s working and what’s broken in order to help everyone get the most out of Graylog v2.1. There are a variety of ways to provide feedback, all of which can be found on our community resources page:

We’re super excited about releasing 2.1, and we value your feedback. So please go try out the Alpha and let us know what you think!

Get the Monthly Tech Blog Roundup

Subscribe to the latest in log management, security, and all things Graylog blog delivered to your inbox once a month.