Site icon Graylog

Announcing Graylog v2.3.0-alpha.2

Today we are releasing Graylog v2.3.0-alpha.2. This is the first public alpha release on our journey to Graylog v2.3!

If you are interested in trying the first version with these new features, please download this alpha release. We love your feedback so please report bugs or any other issues in our GitHub issue tracker.

Please note, as this is an alpha release, there might be bumps along the way and additional changes before the final release.


Download Graylog v2.3.0-alpha.2:


Starting with this release, Graylog is switching from the Elasticsearch node client (using the version-specific binary protocol) to a lightweight HTTP client. This enables Graylog to use all major versions of Elasticsearch which are currently available, including 5.x.

If you want to know more about the differences and implications of the different ways to access an Elasticsearch cluster, you can read more about it in Elasticsearch’s documentation.

For detailed advice on how to configure the Elasticsearch part of a new Graylog installation or migrate from an existing configuration, you can view our upgrade notes.

If you would like to read up on the technical details, you can inspect the relevant changes.


Enriching messages with data from external sources, such as CSV files, Geo IP data, or results from remote HTTP sources is a common pattern in today’s log management. Graylog now supports a core framework for lookup tables, making it easy to work with external data sources.

Lookup Tables are fully pluggable and always consist of a combination of a data adapter, which is providing the data and a cache. Out of the box Graylog ships with three data adapters:

There are various ways to interact with lookup tables in Graylog, allowing to build powerful workflows.
After a lookup table is created, it is accessible from:

Data adapters in Graylog can return both single values as well as complex data structures. For example, the GeoIP data adapter returns the latitude/longitude pair as its simple value, but the entire GeoIP database entry for the multi value case. This offers you the flexibility in pipeline rules to enrich as much or as little data as required.

The same is true for the other data sources like HTTP. This means you could decorate search results with data from your customer database, including information such as contact addresses, SLA levels, or host names.

Since you can choose the caching strategy for each lookup table individually, you can tailor them to the specific requirements, such as heavy caching for incoming messages to maintain a high performance ingestion or very short caching on search result decoration.


Below are the changes we made in v2.3.0-alpha.2 since Graylog v2.2:






Exit mobile version