Cyber Defense with MITRE Framework | Graylog + SOC Prime | On-Demand Webinar >>

The Graylog blog

Announcing Graylog v4.1 Release Candidate

We are excited to announce the Graylog v4.1 Release Candidate. We’re about to wrap this release with a beautiful bow, but there’s still time for you to take one more pass through it. Enjoy and happy logging!


  • The v4.1 RC will run for several days.
  • This is the final build before the official release.
  • There are no prerequisites for the v4.1 RC.
  • Please install the v4.1 RC separately from your production Graylog instance.
  • Please report bugs and any other issues in our GitHub issue tracker.
  • Thank you for testing!


Graylog v4.1 includes a number of new features for Open Source, Enterprise, and Cloud, as well as new Data Adapters, improvements to existing Enterprise Data Adapters, UI Enhancements, and more.



Tarballs (manual installation):


In the upcoming 4.1 release of Graylog, we are making the Cloud Forwarder available in Graylog Enterprise. Now you can configure your Forwarder to send data to Graylog Cloud or to an on-premise Graylog Server cluster.

Tarball (manual installation):

OS Packages

Please report bugs and any other issues in our GitHub issue tracker. Thank you!


  • We are not including OVA or AWS downloads for the beta.
  • If you’ve configured an S3 Archiving backend, you need to delete it before upgrading to the RC.
  • We caution you not to install or upgrade Elasticsearch to 7.11 and later! It is not supported. If you do so, it will break your instance!


  • Redesign Aggregation builder
  • Log View Widget (enterprise)
  • Widget focusing
  • Redesign Search Time Range Picker
  • New export formats JSON, NDJSON, Plain Text (enterprise)
  • Highlighting rule gradient option
  • Responsiveness of dashboard tabs bar
  • Value actions on pie and bar chart
  • Parameter options select (Enterprise)
  • Heatmap color scale
  • Time range info for dashboard widgets
  • LDAP/AD Data Adapter(Enterprise)
  • Back-end REST API for Theme Customizer
  • GreyNoise basic data adapter for Open Source
  • GreyNoise enhanced data adapter for Enterprise
  • URLhaus data adapter for Enterprise
  • MongoDB storage for data adapter data that used to be stored in memory
  • Back-end REST API for Custom Notifications
  • Archive support for S3
  • Okta authentication support and teams sync
  • Custom theming and Notifications for Enterprise
  • Okta Authentication and Teams Sync

Please report bugs and any other issues in our GitHub issue tracker. Thank you!

Get the Monthly Tech Blog Roundup

Subscribe to the latest in log management, security, and all things Graylog Blog delivered to your inbox once a month.