API Security adds Continuous Discovery and Risk Scoring PLUS a Free Version | LEARN MORE>

The Graylog blog

Today we are officially releasing Graylog v3.2.3.

This release includes the ability to share searches in real-time and the return of our popular “surrounding search” function that had to be temporarily removed due to work on consolidating all the search functions in 3.2.

Many thanks to our community for reporting issues and contributing fixes!

DOWNLOAD LINKS

 

Please report bugs and any other issues in our GitHub issue tracker. Thank you!

NEW: REAL-TIME SHARING OF SAVED SEARCHES

Saved Search Sharing

Many times two sets of eyes are better than one when you’re exploring data. Now with Graylog, you can accelerate investigations by sharing saved searches in real-time. For example, you’re investigating a processing timeout across multiple systems but having no luck pinpointing the cause. You need help to find and fix it fast. With the new sharing feature, you can immediately share your search with a colleague. You can view the same data simultaneously, even if you’re in different locations, and explore the data together.

UPDATE: SURROUNDING SEARCH

Threat hunting and incident response are more powerful with surrounding search.

In the search window, pinpoint the log message that interests you, specify the parameters, and then the specifications for additional log messages. Graylog will return the results in a new search window, highlighting the message from the original log, and the surrounding messages before and after it based on time, ip address, or other parameter.

Surrounding search is a great way to get real-time answers, then explore your data once you have a starting point. For example, if you have a malicious code execute on an endpoint, you can initiate a query to retrieve the relevant log message from that endpoint, plus request a list of all log messages for the 5 minutes before and after on that endpoint or retrieve log data on all surrounding ip addresses within a 10 minute window at the same time. This gives you the ability to quickly see what else was happening to that machine or nearby machines within the relevant time frame all in one step.

UPDATE: REPLAY SEARCH

Dashboard Widget Graph
                              

Press play to explore information on your graph results. For example, if you see something out of the ordinary on the Dashboard visualization (e.g., a performance spike) and you want a closer look at the logs represented in the widget, you can click play and Graylog will initiate a new search and return the results in a separate tab, replaying the event with all relevant log messages in order.  

UPDATE: SUPPORT FOR NEWER KAFKA VERSION

To provide users with more customization options, Graylog v3.2.3 added support for newer Kafka versions.

GRAYLOG ENTERPRISE 3.2.3

Fixed

  • Fixed issue with custom fields and correlation event definitions.

GRAYLOG 3.2.3

Added:

Changed

Fixed

Get the Monthly Tech Blog Roundup

Subscribe to the latest in log management, security, and all things Graylog Blog delivered to your inbox once a month.