Configure Forwarder Input Profiles

The Forwarder is a feature that is exclusively available for Graylog Cloud, Graylog Security, and Graylog Enterprise. To learn more about Graylog licenses, please contact the Graylog Sales team.

This guide explains how Forwarder input profiles control what each Forwarder host collects. Input profiles are created in the Graylog interface and assigned to Forwarder nodes after registration. Each profile contains one or more inputs, and each input defines a listener that runs directly on the host. Forwarder does not discover log sources automatically, so all collection behavior must be defined through input profiles.

You will learn how input profiles work, how to create and assign them, how Forwarder applies updates, and how to test, manage, and troubleshoot profiles effectively.

How Input Profiles Work

Input profiles group multiple inputs together so that the Forwarder can start the required listeners on a host. When you assign a profile to a Forwarder, the Forwarder starts each input contained in that profile. These inputs behave the same way as inputs configured on a Graylog server.

A Forwarder can be assigned only one input profile at a time. The Forwarder checks the forwarder input on port 13302 for updates and retrieves changes made in the Graylog interface. When a profile is updated, the Forwarder restarts or adjusts only the affected inputs.

Create an Input Profile

Input profiles are created and managed in the Graylog interface.

Navigate to System > Forwarders.
Select Input Profiles.
Select Create Input Profile.
Enter a descriptive name for the profile.
Add one or more inputs to the profile.
Save the profile.

Profile names should reflect the log source or purpose, such as Linux system logs, Nginx logs, Application logs, Syslog TCP listeners, or Journald collectors. Forwarder does not limit the number of profiles you can create.

Inputs in a Profile

Each input defines a specific log source. Common input types include the following:

Syslog TCP or UDP: Listens on a network port for Syslog messages.
Beats: Listens for output from any Beats log collector.
AWS S3: Monitors S3 buckets for incoming messages.
Application listeners: Listen on a network port for application-specific log formats.

You can add multiple inputs to a single profile. Forwarder runs each input as an independent listener on the host.

Assign an Input Profile to a Host

After a Forwarder registers with Graylog, assign an input profile to determine which inputs run on the host.

Navigate to System > Forwarders.
Select the Forwarder host.
Select Assign Profile.
Select the profile you want to assign.
Save the assignment.

The Forwarder retrieves its new profile assignment from the forwarder input during the next update cycle. Inputs start automatically based on the assigned profile. If the Forwarder does not start a required input, verify that the host can access all necessary ports.

Test Input Profiles

Before deploying a profile to multiple hosts, you can test it on a single Forwarder to validate behavior. To do so:

Assign the profile to one Forwarder host.
Confirm that the profile appears as active in the Graylog interface.
Check the Forwarder logs on the host for input startup messages.
Verify that data reaches Graylog through the forwarder input.

This confirms that file paths, permissions, and network ports are configured correctly.

Manage Syslog Inputs

Syslog inputs listen on TCP or UDP ports. Binding to ports below 1024 requires root privileges or the appropriate system capabilities. If the Forwarder runs without elevated permissions, configure Syslog inputs to use ports above 1024 or grant the required capability.

The Forwarder supports multiple Syslog listeners; however, if two inputs attempt to use the same port on the same host, Forwarder will not start the second listener. Always test Syslog inputs using a simple logger utility or a test device.

Profile Updates

When you update an input or an input profile, the following occurs:

The Forwarder retrieves the update from the forwarder input.
The Forwarder restarts only the inputs affected by the change.
The Forwarder writes update results to its local logs.

A full host restart is not required unless the forwarder.conf file changes.

Delete Input Profiles

When you delete a profile, the Forwarder removes all inputs linked to that profile during its next update cycle. Inputs stop running immediately after the Forwarder receives the update. Hosts assigned to other profiles continue to run their remaining inputs without interruption.