Create and Manage Collections

The following article exclusively pertains to a Graylog Enterprise feature or functionality. To learn more about obtaining an Enterprise license, please contact the Graylog Sales team.

Collections let you gather related entities so that you can easily share them as a single action. This feature can be used with individual users and with teams.

This article explains how to create and manage collections.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

You must be a Graylog administrator to manage collections.
Ensure you understand the Graylog permission model, specifically roles and sharing.

Add Content to Collections

The following sections explain how to create collections in Graylog and how to share collections with your users or teams.

Collections are useful only when they contain entities. In Graylog, an entity refers to any distinct resource or component within the system that you can manage and interact with. For collections, you add entities such as streams, dashboards, reports, and others. See Collections for a complete list of entities.

You can add entities to collections when you create them, as well as update collection membership for existing entities. See the documentation for each entity type for details.

Create a Collection

To create a collection, navigate to Enterprise > Collections:

Click Create.
Enter a Title and Description. Both fields are required.
(Optional) Include any collaboration options. See the Add Collaboration section for details.
Click Create collection.

The new collection is added to the table view. Select a collection title to view the collection detail page, which shows entities that have been added to the collection.

You add entities to a collection from the entity pages or when you create the entity. You can modify existing collection membership by using the Manage collections option, usually found under the More menu on the entity list.

Add Collaboration and Sharing

The Graylog permissions model requires you to grant access to any intended collaborators on an entity. You can share entities with individuals or teams when you create the entity.

Add Collaborator

Use the Add Collaborator section to share the entity with individual users or teams. You can set a different access level for each collaborator you add.

Enter a search term or scroll the list to find a user or team to add.
Select the access level the user should receive:
- Viewer: Can view the entity but not make any changes to it.
- Manager: Can edit any aspect of the entity. For some entities, this access level allows the user to delete the entity.
- Owner: Has the same permissions as Manager but adds the ability to share the entity with other users.
Click Add Collaborator.

Repeat these steps for each collaborator you want to add. As you add collaborators, they are listed with their access level. You can change the access level or delete a collaborator before proceeding.

Share Collection Contents

When you share collection contents with users or teams, you grant access to the entities within the collection. You share the collection contents from the Collections page at Enterprise > Collections.

Hint: Sharing entities via collections does not change the roles assigned to those users. Users still must be assigned appropriate roles to view or edit specific entities. Make sure you understand the Graylog permission model.

To share collection contents:

From the Collections page, select Share Contents on the collection you want to share. Note that you can also select Share Contents on the collection detail page.
Add a user or team, set the access level, then click Add Collaborator.

Hint: If any entities in the collection rely on other entities not included (such as a report requiring a dashboard), and the collaborator lacks access, a warning lists missing dependencies.
(Optional) Add additional collaborators as necessary.
Click Update sharing.

Manage Collections

To view existing collections, navigate to Enterprise > Collections. The table lists all the collections that have been created and shows details about the collection. Select a collection title to view its detail page, which lists all entities that have been added.

The Collections page is also where you control how you share collections. You can share both:

The collection content: Grants access to the entities within the collection.
The collection itself: Grants access to view or modify the collection metadata.

For the steps to share collection content, see Share Collection Content above. The sections below describe how to update details of the collection itself and change existing sharing options.

Add Collaborators

To add collaborators to the collection itself:

From the main Collections page, select Manage on the collection you want to share.
Enter a search term or scroll the list to find a user or team to add.
Select the access level the user should receive. The definition of each access level is slightly different from other sharing options:
- Viewer: Can see the collection on the Collections page, and can see entities in the collection by title only.
- Manager: Can add and remove entities from the collection, in addition to all Viewer access.
- Owner: Can edit the title and description of the collection and delete the collection, in addition to all Viewer and Manager access.
Select Add Collaborator. Repeat these steps if you want to add multiple collaborators.
Select Update sharing.

Edit Collection Details

To edit details of a collection:

Select the More menu in the Actions column, then select Edit.
Select Edit.
In the dialog box, you can update the title and description of the collection.
Select Update collection.

Hint: This option only changes the collection’s metadata. Use other controls to modify its content or access settings.

Remove an Entity

To remove an entity from a collection:

Select the collection title to go to the detail page. The collection detail page lists all the entities that have been added to it.
Select Delete in the Actions column for the entity you want to remove.
Click Confirm in the dialog box to complete the deletion.

Note that you can select the check boxes for items, then use the Bulk actions menu to delete multiple items at once.

Update Sharing Options

To change or remove shared collection content:

Select a collection title to view its detail page.
Select Share Content.
In the Sharing Collection Content dialog box, you can:
- Add sharing for additional users or teams.
- Change the access level of existing users or teams.
- Remove sharing for existing users or teams.
Select Update sharing.