Announcing Graylog 3.2.3

Last updated:
March 12, 2020

Today we are officially releasing Graylog v3.2.3.

This release includes the ability to share searches in real-time and the return of our popular “surrounding search” function that had to be temporarily removed due to work on consolidating all the search functions in 3.2.

Many thanks to our community for reporting issues and contributing fixes!



Please report bugs and any other issues in our GitHub issue tracker. Thank you! 


Saved Search Sharing

Many times two sets of eyes are better than one when you're exploring data. Now with Graylog, you can accelerate investigations by sharing saved searches in real-time. For example, you’re investigating a processing timeout across multiple systems but having no luck pinpointing the cause. You need help to find and fix it fast. With the new sharing feature, you can immediately share your search with a colleague. You can view the same data simultaneously, even if you’re in different locations, and explore the data together.


Threat hunting and incident response are more powerful with surrounding search.

In the search window, pinpoint the log message that interests you, specify the parameters, and then the specifications for additional log messages. Graylog will return the results in a new search window, highlighting the message from the original log, and the surrounding messages before and after it based on time, ip address, or other parameter.

Surrounding search is a great way to get real-time answers, then explore your data once you have a starting point. For example, if you have a malicious code execute on an endpoint, you can initiate a query to retrieve the relevant log message from that endpoint, plus request a list of all log messages for the 5 minutes before and after on that endpoint or retrieve log data on all surrounding ip addresses within a 10 minute window at the same time. This gives you the ability to quickly see what else was happening to that machine or nearby machines within the relevant time frame all in one step.


Dashboard Widget Graph

Press play to explore information on your graph results. For example, if you see something out of the ordinary on the Dashboard visualization (e.g., a performance spike) and you want a closer look at the logs represented in the widget, you can click play and Graylog will initiate a new search and return the results in a separate tab, replaying the event with all relevant log messages in order.  


To provide users with more customization options, Graylog v3.2.3 added support for newer Kafka versions.  

Graylog Enterprise 3.2.3


  • Fixed issue with custom fields and correlation event definitions.

Graylog 3.2.3




Get Graylog

See Demo