Illuminate content is typically updated automatically by Graylog. However, if you are not able to receive these updates in your environment because your Graylog server cannot access the public internet, you need to perform a manual update to receive new Illuminate content.

The following article describes how to update existing Illuminate content using an externally provided content obtained from your sales representative.

Hint: If your Graylog server cannot access the public internet, you can turn off notifications for new Illuminate versions, since they can generate error messages. Adjust the following setting in your server.conf file to turn off Illuminate version notifications: illuminate_hub_new_version_check_interval=0s.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

  • A valid Enterprise or Security license.

  • You must be a Graylog administrator.

Illuminate Content Manual Update

To manually update Illuminate content, follow these steps:

  1. Request the latest content from your sales representative.

  2. Download the file to a system that can be used to access the Graylog server web interface where Illuminate is installed.

  3. Enable access to the Illuminate Install page.

  4. Navigate to the Illuminate Install page, then upload the content.

Enable the Installation Page

By default, the Illuminate Install page is not accessible through the Graylog web interface. If you need to perform manual updates of Illuminate content, you must first enable the Illuminate Install page:

  1. Open your server.conf file with the following command:

    Copy 
    sudo nano /etc/graylog/server/server.conf

    If prompted, enter your administrator password.

  2. Set the illuminate_hub_new_version_check_interval property in server.conf to 0s:

    Copy 
    illuminate_hub_new_version_check_interval=0s

  3. Save and exit the server.conf file. For example, on some consoles, you can select Ctrl + X to exit the file, enter Y to save the file and overwrite the previous version, and then enter again to save the file with the same name.

  4. Restart the Graylog service with the following command:

    Copy 
    sudo systemctl restart graylog-server.service

After Graylog restarts, you can navigate back to Enterprise > Illuminate and find the Manual Upload Page button on the Content Hub page.

For more information about updating server.conf, see Graylog Server Configuration.

Hint: You need to enable this setting only once. If you will continue to need to use the manual upload option, you can leave the Illuminate Install page accessible in your environment.

Upload Content

Before proceeding to this section, make sure you have content ready to upload and make sure you have enabled the Illuminate Install page.

  1. Navigate to the Content Hub at Enterprise > Illuminate.

  2. Click Manual Upload Page.

  3. Drag and drop the new content to the upload box on the right, or click the box, then navigate to find the content.

The screen shows the installation progress. When all content is installed, the screen returns to the Content Hub where you see the list of all available content packs.