Lennart Koopmann

I am in the last steps of a Graylog2 v0.9.6 beta release these days: There are only a few tickets for the server and web interface left.

I’d like to take some time and give you an overview about what is changing and coming in this next version of Graylog2.

ElasticSearch is the new message storage

MongoDB has been dropped as message storage. It will stay for message counts (see faster graphs), settings and health values but no longer for storing the actual messages. Reason for this are performance problems when storing a lot of messages. To get a good speed it would have to keep all the messages in memory. ElasticSearch offers fast reads and real full text search features. Future versions of Graylog2 will make use of the full text search features of ElasticSearch - In 0.9.6 you will only get a huge performance increase. MongoDB is still great for storing the other stuff, but using it for the log messages seems to have been a mistake.

Faster graphs

In prior Graylog2 releases the graphs (like the analytics graph and the small stream graphs) were generated (and cached) from actual counts against the message collection. This was getting really slow if you had a high message throughput. From 0.9.6 on the server will count and store the message counts for per minute in MongoDB. This is not only much faster and less IO intensive but also more user friendly: Because it is independent from the message storage you can draw graphs over time periods that are no longer in ElasticSearch. You will be able to only keep messages of the last 2 months, but draw graphs over years. The UI for this will also change to allow easy drawing of long term graphs.

The Analytics Shell

Note that this screencast shows an early version of the shell. Count, distinct, and distribution queries for example are now displayed in the shell itself, not below it. You can also use stream names instead of their IDs for stream selectors.

See this blog post for an explanation and the screencast of the new Analytics Shell: http://www.lennartkoopmann.net/post/6801339730/graylog2-analytics-shell

Also check out the wiki page explaining the shell: https://github.com/Graylog2/graylog2-web-interface/wiki/The-Analytics-shell

New stream filter rules

There are some new stream filter rules like filename/line, regex host, full message and an “or higher” option for severities.

Hostgroups are dead

The hostgroups functionality has been removed. Read this explanation blog post for more information.

Bugfixes and improvements

A lot of bugfixes and improvements. There were some bugs in previous versions that could have been avoided. - Sorry about that. To avoid that in the future there will be a beta release and extended testing phase before releases. Expect improvements in the UX like the one for empty streams: When you created a stream it had no rules and was matching all messages coming in. From now on streams with no rules catch no messages. Streams are also disabled until you enable them - For example after fully configuring the stream rules and alarms.

All in all you can expect a double-awesome version 0.9.6 of Graylog2 that focuses on performance for huge amounts of log messages and long term archiving.

There will be a beta version very soon! A preview version with working ElasticSearch integration is already available for download.

Subscribe to this blog, the @graylog2 Twitter stream or the mailing list to stay up to date!

The next version of Graylog2 (0.9.6) will no longer include hostgroups. Let me explain why: You can now build hostgroups using streams since there is a hostname regex matcher rule. The difference is that you are more flexible because of all the other stream filters available. Keeping the hostgroups alive would basically mean having a duplicated feature with less flexibility.

Suggestions or feedback on the mailing list or in the comments of this post.

I am currently working on this new Graylog2 feature. (Screenshot shows the very early stage and is pretty ugly) You will be able to define rules on a time axis that trigger an event. You can define actions (like executing a script, sending an email, …) for whenever an event or a number of events are triggered. Also expect some fancy graphs going far into the history which are perfect for

This will require some Java and Rails hacking in the next time and I am not sure yet if this will make it into the 0.9.6 release or not. Let me know about your thoughts, ideas and suggestions!

I am also very interested in what kind of events you would like to set up.

I spent my last evenings hacking on a new Graylog2 feature which will be very useful for running powerful analytics on your log messages: The Graylog2 Analytics Shell. The detailled description is in the wiki.

Use this shell to extract information from your log messages. I always like the use case of API monitoring. You could easily find out if that one call is still used by consumers - Or even which consumers are still using it with a simple distinct call:

all.distinct({_oauth_consumer_key}, processed_controller = /^PrivateMessages#.+/)

Watch the shell in action in this short screencast: (Try the full screen mode and HD video)

This is the first working implementation but there is still stuff missing. For example:

• Shell history available with up and down arrow keys
• Improved design and layout
• A history of count and distinct results
• Tab completion (ZOMG!!)
• Saving and sharing of commands
• Short names for streams, to avoid typing the raw stream ID

The shell will be included in the next version: 0.9.6

Post your comments here or discuss in the mailing list.

Yay, celebrate! I just released Graylog2 v. 0.9.3 (graylog2-server and graylog2-web-interface). Here is a list of noteworthy changes:

Host groups

You can now create host groups that show all messages of hosts you added. This can be useful if you want to get an overview of all messages of a cluster or type of hosts.

Read More

I wrote and published a gem that you can load as Rack middleware in your Rails application. It transparently fetches all your Exceptions (and throws them back to the application so it does not affect your own Exception handling) and sends them as a GELF message to your Graylog2 installation.

Installation

Install the gem. It has my GELF gem as dependency and will install it automatically:

lennart ~$ sudo gem install graylog2_exceptions
Successfully installed gelf-0.9.1
Successfully installed graylog2_exceptions-0.5.3

Now open your config/environment.rb and add the gem as Rack middleware: (Make sure to require 'graylog2_exceptions' before.)

config.middleware.use "Graylog2Exceptions", { :host => '127.0.0.1', :port => '12201', :local_app_name => 'mama' }

Parameter explanation:

• host: The hostname or IP of your Graylog2 server
• port: The GELF port your Graylog2 server is listening on (Standard: 12201)
• local_app_name: This name will be used as “host” field (Optional)
• level: The syslog level for all Exceptions (Optional)

That’s it: Restart your app and all your Exceptions will be logged to Graylog2!

(Source code of the gem at GitHub)

I just released Graylog2 v. 0.9.2 - New in this version:

• Graphs - Will be extended in future versions
• Automatic refresh for dashboard
• Web interface now compatible with MongoDB v. >= 1.6.0
• Remove messages hit by a quickfilter or stream
• Raised maximum size of GELF messages to 8192 byte
• Huge server performance impact by using thread pooling techniques
• Some minor bugfixes

…and there are great plans for coming versions! I’ll write an article about what is in my mind soon.

Download as usual from: http://www.graylog2.org/download

Also: Become a fan of Graylog2 on Facebook

The guide has moved here: https://github.com/Graylog2/graylog2-web-interface/wiki/Installing-the-web-interface-on-Debian-5.0

The guide has moved here: https://github.com/Graylog2/graylog2-server/wiki/Installing