For the links to the most recent Graylog releases, visit the Releases section of the Graylog Blog!

Warning: Please make sure to create a MongoDB database backup before starting the upgrade to Graylog 4.3.

For full installation procedures, including methods of installation and configuration options, please review the Installing Graylog user guide.

4.3.x Compatibility

Elasticsearch Version Compatibility

GRAYLOG VERSION MINIMUM ES VERSION MAXIMUM ES VERSION
4.3.x 6.8 to 7.10.2 7.10.2

MongoDB Version Compatibility

GRAYLOG VERSION
 MINIMUM MONGO VERSION
 MAXIMUM MONGO VERSION
4.3.x 3.6 4.4

Notable API Endpoint Changes

Endpoint Description
GET /api/system/configuration The field stale_master_timeout has been deprecated. It is still present in the response object for backwards compatibility but will hold the same value as the new stale_leader_timeout field, which has been added as a replacement.

Removed Migrations

  • Removed two migrations that convert pre-1.2 user permissions and index ranges to newer formats.
  • Removed a migration that was recalculating the index ranges of the default stream's index set for pre 2.2 Graylog installations.

Configuration File Changes

Option Action Description
is_master removed Replaced with is_leader. For backwards compatibility, is_master will still be evaluated, but is_leader takes precedence, if both are configured.
stale_master_timeout removed Replaced with stale_leader_timeout. For backwards compatibility, stale_master_timeout will still be evaluated, but stale_leader_timeout takes precedence, if both are configured.
index_field_type_periodical_interval removed To control index field type refreshing, the new index_field_type_periodical_full_refresh_interval may be used instead.
is_leader added Replacement for is_master to promote inclusive naming.
stale_leader_timeout added Replacement for stale_master_timeout to promote inclusive naming.
index_field_type_periodical_full_refresh_interval added Allows users to tweak the default interval after which field type information will be refreshed for all indices.

Behavior Changes

  • Pipeline function drop_message was modified to provide more performance and
    predictable results: When drop_message is called in a rule, we complete processing of
    the current stage; following stages are skipped. Other pipelines operating on the same message will
    complete stage numbers less than or equal to the aborting stage; higher numbered stages are skipped.
  • The key_value pipeline function was improved to handle quoted values. This can result in different (but now correct) parsing results when quoted values include the key-value separator. (see graylog2-server#11738)
  • Restarting the server would restart all inputs, even those that were manually stopped.
    We now persist the desired input state: manually stopped inputs remain stopped, even after a server restart.
    Users can choose the legacy behaviour by setting a flag in the graylog.conf:
    auto_restart_inputs = true