7 ms·

Graylog2 v0.20.0 released

tweiss 13y ago
Great to see that there is (almost) always a great open source alternative to expensive proprietary IP products! Splunk can become very expensive very quickly if you have a lot of data, so this is great news. Wish they would have shorter release cycles though...
- lennartkoopmann 13y ago
  Thanks! :) Regarding the release cycles: We just released v0.20.1 - just a week after v0.20.0. It took us a while to build us this foundation but now we are constantly releasing updates on top.
izzydata 13y ago
I don't know if it is just my browser, but at the top of the page where it says "everything we learned from users" the "d" in learned and the "f" in users are on-top of eachother. Sorry I don't have anything constructive to post.
- lennartkoopmann 13y ago
  oh, what browser is that?
  - izzydata 13y ago
    Chrome on Fedora Linux. Here is a screenshot. https://dl.dropboxusercontent.com/u/58437091/Selection_016.png https://dl.dropboxusercontent.com/u/58437091/Selection_016.p...
    - lennartkoopmann 13y ago
      Thank you! I'll look into that.
    - skywhopper 13y ago
      I see similar formatting issues with Chrome a lot, on Windows as well as on Linux.
- thwarted 13y ago
  I see this more often than I'd like and I think this is a race condition with custom fonts. It calculates the bounding box for words, then the font is downloaded, the font is rerendered, but the bounding box isn't updated for the new font's metrics. A reload, since the downloaded files are now cached, usually fixes it.
hijinks 13y ago
This has come a long way since I last used it around 3 or so years ago. I'm looking forward to trying it now since it's re-done and ditched mongodb for elasticsearch.
scotth 13y ago
Is the graylog beast still the logo? I love that guy.
- lennartkoopmann 13y ago
  Unfortunately not! It came with permission from theoatmeal but now that we approach bigger things with Graylog2 we felt like we have to get an own logo. You can still expect stuff like the famous Party Gorilla (aka "That drunk sloth") though. ...and rumors are that he might come back in some way.
deleted 13y ago
[deleted]
e12e 13y ago
Oh, this is great news. One more project off my never-ending todo-list (write log aggregator backed by elastic search). Nice to see binary packages for Debian too!
btgeekboy 13y ago
I started playing with this over the weekend. Great stuff. Also, if you're on the fence about whether to use this or Kibana, they're compatible with each other, so give them both a try. (Set up Graylog2, point Kibana at G2's elasticsearch instance, profit.)
cstuder 13y ago
Has anyone compared Kibana with Graylog 0.20 series recently? My use case is (currently) more in exceptions catching than performance monitoring. Judging from that screenshots alone, I would say that Graylog is a better fit for me.
- lennartkoopmann 13y ago
  Kibana is a great product for very dynamic analysis and is definitely still better there than Graylog2. However, we hear from a lot of people that they prefer Graylog2 for monitoring and searching. Also Graylog2 has stuff like a user/role model, (authenticated) REST APIs and generally a more integrated approach. I suggest you give both a spin and decide. :) Both products are easy to setup.
  - ysleepy 13y ago
    No Kerberos auth via reverse Proxy. Nobody uses it in our team because its the only app where they need to enter a password. A shame since it should be very easy to implement similar to the REMOTE_USER env in other langs, maybe via X-Authenticated header or something for play.
    - btgeekboy 13y ago
      There's an issue on GitHub for this; I've wanted it as well. https://github.com/Graylog2/graylog2-web-interface/issues/560 https://github.com/Graylog2/graylog2-web-interface/issues/56...
reiz 13y ago
Great news. Many Thanks for all the hard work.
bdcravens 13y ago
in the URL: "/wow/such/0.20.0/" in one of the first screen shots: "wow such monitor" I'm guessing that was just a test name for the purpose of the screenshot, or so I hope. However, speaking in general (and not just aiming it at this project), can we please leave the cutesy little Doge talk out of documentation and marketing? I'd say that's true of all "memes" in general. In theory anyone can look at a project if it's useful, and believe it or not, not everyone spends enough time on Reddit or 4Chan to have a clue about what a Doge or a Harlem Shake is. tldr; such dogetalk. much child-like. so annoy. wow.
- ceejayoz 13y ago
  > not everyone spends enough time on Reddit or 4Chan to have a clue about what a Doge or a Harlem Shake is And they're going to be harmed by a meme in the URL to the blog post... how?
  - bdcravens 13y ago
    I was speaking in general, and I see a meme in a URL as an acceptance of the awesomeness of meme-talk. I've seen marketing emails, from allegedly intelligent company presidents, sticking doge-lines in without any context. As if they're trying to say, "ooh.. we're hip and with it, we get the inside joke!". If I pointed a manager or client at a blog entry that contained grammar that was worse than what my 5 year old nephew utters, it'd reflect on me, or at the very least, the project. Again, I think graylog is a neat project, and their use here really is no big deal, but I think the idea of throwing out intelligent sounding communication in the interest of sounding cute is a very bad idea.
- lennartkoopmann 13y ago
  That doge reference in the screenshot actually made it there by mistake. :)
- meritt 13y ago
  I'm ambivalent on this topic. The dogespeak in this particular announcement made me chuckle and envisioned the team as people I'd personally get along with. They're catering to like-minded individuals. If I had opened an IBM-enterprise-blah wall of text, I'd probably have not spent nearly as much time learning about their product.
meritt 13y ago
Never heard of Graylog and after some introductory reading, I'll be giving it a spin today. Thanks!
kordless 13y ago
Congratulations to you and the team Lennart. It looks awesome. Will try it out!
tomsthumb 13y ago
It would be nice to know what Graylog actually is after reading the entire linked page. It left a fluffy impression, but most (all) of the information there is explaining nice things about Graylog. This seems suboptimal from a marketing perspective.
- jsmthrowaway 13y ago
  This is specifically the announcement of the rewrite, go to http://graylog2.org http://graylog2.org for the full pitch. I expect this was some kind of marketing communication to existing customers that got submitted here and polluted the message.
- rossjudson 13y ago
  It has 2000 commits and a REST interface. Was there something else you needed to know?
  - eeeeeeeeeeeee 13y ago
    That page seems to be targeted more at people who already know or have used graylog in the past. If you go to the main website it's more clear and there is a screencast.
cdelsolar 13y ago
I have been unable to use Graylog for a long time now; if anyone can provide any pointers I'd greatly appreciate it. No matter what installation method I try, eventually my Graylog instance crashes, or Mongo crashes, or Elasticsearch crashes, or my hard drive gets filled up with huge amounts of error logs and the whole system grinds to a halt, etc etc etc. I am using an Azure "large" instance and trying to log about 300 or so messages per second. I make sure to only log enough messages so that old ones get thrown away before the hard drive fills up, but it doesn't matter, it still crashes. It also crashes if I add an external large drive and log to there, eventually I will get an insanely large number of elasticsearch errors. I eventually had to take it down because it keeps crashing but now I have no error information. Any help would be greatly appreciated.
- lennartkoopmann 13y ago
  Please contact the mailing list and we are happy to help. 300 msgs/sec is not much and we should easily get that unter control. :)
atmosx 13y ago
By going through the page I understood: * Graylog2 is probably version 2 of Graylog (fair enough) * It's a data analytics platform, where you can feed your syslog. * Has a REST interface What I would like to understand but was not able to: * Do they open source both client and server? * Is it only a server app with a web interface? * To they sell anything at all? (support, plans, etc)
- lennartkoopmann 13y ago
  It's all open source, you can feed any data, not only sylog and TORCH (http://www.torch.sh http://www.torch.sh) is selling commercial services. Also take a look at: http://support.torch.sh/help/kb/general/graylog2-architecture-high-level-overview http://support.torch.sh/help/kb/general/graylog2-architectur... The feedback here definitely helped us identify that we need to make our websites more obvious about what Graylog2 is actually doing. Thanks!
xfalcox 13y ago
Does this compare to logstash? I'm trying to decide what log aggregator use, and I don't have much time to test both. BTW, I'm running SLES 11 SP 2.
xfalcox 13y ago
Does this compare to logstash? I'm trying to decide what log aggregator use, and I don't have much time to test both. BTW, I'm running SLES 11 SP 2.
Don_E 13y ago
We are heavy users of both Graylog2 and Logstash and they both shine at different things at the moment. In an enterprise context with lots and lots of logs Graylog2 is making the process of segregating access to certain logs very,very easy. It's interface is a lot less "bling bling" than Kibana but much easier to use for a certain type of users. Logstash is still king for parsing logs into structured events (and we use it a LOT - our current config file is ~2.5k lines) but we had issues with stability and loosing messages (crashes due to character issues, etc). The core of Graylog2 rocks - it's stable and very performant (we are pushing 30k+ msgs/s over a single node with room to spare) and the support we have received from the Graylog2 team has been nothing but awesome. I am confident that they will catch up with Kibana (in terms of visualisations) very, very quickly.

Great to see that there is (almost) always a great open source alternative to expensive proprietary IP products! Splunk can become very expensive very quickly if you have a lot of data, so this is great news. Wish they would have shorter release cycles though...

lennartkoopmann 13y ago
Thanks! :) Regarding the release cycles: We just released v0.20.1 - just a week after v0.20.0. It took us a while to build us this foundation but now we are constantly releasing updates on top.

izzydata 13y ago

I don't know if it is just my browser, but at the top of the page where it says "everything we learned from users" the "d" in learned and the "f" in users are on-top of eachother. Sorry I don't have anything constructive to post.

lennartkoopmann 13y ago
oh, what browser is that?
- izzydata 13y ago
  Chrome on Fedora Linux. Here is a screenshot. https://dl.dropboxusercontent.com/u/58437091/Selection_016.png https://dl.dropboxusercontent.com/u/58437091/Selection_016.p...
  - lennartkoopmann 13y ago
    Thank you! I'll look into that.
  - skywhopper 13y ago
    I see similar formatting issues with Chrome a lot, on Windows as well as on Linux.
thwarted 13y ago
I see this more often than I'd like and I think this is a race condition with custom fonts. It calculates the bounding box for words, then the font is downloaded, the font is rerendered, but the bounding box isn't updated for the new font's metrics. A reload, since the downloaded files are now cached, usually fixes it.

hijinks 13y ago

This has come a long way since I last used it around 3 or so years ago. I'm looking forward to trying it now since it's re-done and ditched mongodb for elasticsearch.

scotth 13y ago

Is the graylog beast still the logo? I love that guy.

lennartkoopmann 13y ago
Unfortunately not! It came with permission from theoatmeal but now that we approach bigger things with Graylog2 we felt like we have to get an own logo. You can still expect stuff like the famous Party Gorilla (aka "That drunk sloth") though. ...and rumors are that he might come back in some way.

deleted 13y ago

[deleted]

e12e 13y ago

Oh, this is great news. One more project off my never-ending todo-list (write log aggregator backed by elastic search). Nice to see binary packages for Debian too!

btgeekboy 13y ago

I started playing with this over the weekend. Great stuff. Also, if you're on the fence about whether to use this or Kibana, they're compatible with each other, so give them both a try. (Set up Graylog2, point Kibana at G2's elasticsearch instance, profit.)

cstuder 13y ago

Has anyone compared Kibana with Graylog 0.20 series recently? My use case is (currently) more in exceptions catching than performance monitoring. Judging from that screenshots alone, I would say that Graylog is a better fit for me.

lennartkoopmann 13y ago
Kibana is a great product for very dynamic analysis and is definitely still better there than Graylog2. However, we hear from a lot of people that they prefer Graylog2 for monitoring and searching. Also Graylog2 has stuff like a user/role model, (authenticated) REST APIs and generally a more integrated approach. I suggest you give both a spin and decide. :) Both products are easy to setup.
- ysleepy 13y ago
  No Kerberos auth via reverse Proxy. Nobody uses it in our team because its the only app where they need to enter a password. A shame since it should be very easy to implement similar to the REMOTE_USER env in other langs, maybe via X-Authenticated header or something for play.
  - btgeekboy 13y ago
    There's an issue on GitHub for this; I've wanted it as well. https://github.com/Graylog2/graylog2-web-interface/issues/560 https://github.com/Graylog2/graylog2-web-interface/issues/56...

reiz 13y ago

Great news. Many Thanks for all the hard work.

bdcravens 13y ago

in the URL: "/wow/such/0.20.0/" in one of the first screen shots: "wow such monitor" I'm guessing that was just a test name for the purpose of the screenshot, or so I hope. However, speaking in general (and not just aiming it at this project), can we please leave the cutesy little Doge talk out of documentation and marketing? I'd say that's true of all "memes" in general. In theory anyone can look at a project if it's useful, and believe it or not, not everyone spends enough time on Reddit or 4Chan to have a clue about what a Doge or a Harlem Shake is. tldr; such dogetalk. much child-like. so annoy. wow.

ceejayoz 13y ago
> not everyone spends enough time on Reddit or 4Chan to have a clue about what a Doge or a Harlem Shake is And they're going to be harmed by a meme in the URL to the blog post... how?
- bdcravens 13y ago
  I was speaking in general, and I see a meme in a URL as an acceptance of the awesomeness of meme-talk. I've seen marketing emails, from allegedly intelligent company presidents, sticking doge-lines in without any context. As if they're trying to say, "ooh.. we're hip and with it, we get the inside joke!". If I pointed a manager or client at a blog entry that contained grammar that was worse than what my 5 year old nephew utters, it'd reflect on me, or at the very least, the project. Again, I think graylog is a neat project, and their use here really is no big deal, but I think the idea of throwing out intelligent sounding communication in the interest of sounding cute is a very bad idea.
lennartkoopmann 13y ago
That doge reference in the screenshot actually made it there by mistake. :)
meritt 13y ago
I'm ambivalent on this topic. The dogespeak in this particular announcement made me chuckle and envisioned the team as people I'd personally get along with. They're catering to like-minded individuals. If I had opened an IBM-enterprise-blah wall of text, I'd probably have not spent nearly as much time learning about their product.

meritt 13y ago

Never heard of Graylog and after some introductory reading, I'll be giving it a spin today. Thanks!

kordless 13y ago

Congratulations to you and the team Lennart. It looks awesome. Will try it out!

tomsthumb 13y ago

It would be nice to know what Graylog actually is after reading the entire linked page. It left a fluffy impression, but most (all) of the information there is explaining nice things about Graylog. This seems suboptimal from a marketing perspective.

jsmthrowaway 13y ago
This is specifically the announcement of the rewrite, go to http://graylog2.org http://graylog2.org for the full pitch. I expect this was some kind of marketing communication to existing customers that got submitted here and polluted the message.
rossjudson 13y ago
It has 2000 commits and a REST interface. Was there something else you needed to know?
- eeeeeeeeeeeee 13y ago
  That page seems to be targeted more at people who already know or have used graylog in the past. If you go to the main website it's more clear and there is a screencast.

cdelsolar 13y ago

I have been unable to use Graylog for a long time now; if anyone can provide any pointers I'd greatly appreciate it. No matter what installation method I try, eventually my Graylog instance crashes, or Mongo crashes, or Elasticsearch crashes, or my hard drive gets filled up with huge amounts of error logs and the whole system grinds to a halt, etc etc etc. I am using an Azure "large" instance and trying to log about 300 or so messages per second. I make sure to only log enough messages so that old ones get thrown away before the hard drive fills up, but it doesn't matter, it still crashes. It also crashes if I add an external large drive and log to there, eventually I will get an insanely large number of elasticsearch errors. I eventually had to take it down because it keeps crashing but now I have no error information. Any help would be greatly appreciated.

lennartkoopmann 13y ago
Please contact the mailing list and we are happy to help. 300 msgs/sec is not much and we should easily get that unter control. :)

atmosx 13y ago

By going through the page I understood: * Graylog2 is probably version 2 of Graylog (fair enough) * It's a data analytics platform, where you can feed your syslog. * Has a REST interface What I would like to understand but was not able to: * Do they open source both client and server? * Is it only a server app with a web interface? * To they sell anything at all? (support, plans, etc)

lennartkoopmann 13y ago
It's all open source, you can feed any data, not only sylog and TORCH (http://www.torch.sh http://www.torch.sh) is selling commercial services. Also take a look at: http://support.torch.sh/help/kb/general/graylog2-architecture-high-level-overview http://support.torch.sh/help/kb/general/graylog2-architectur... The feedback here definitely helped us identify that we need to make our websites more obvious about what Graylog2 is actually doing. Thanks!

xfalcox 13y ago

Does this compare to logstash? I'm trying to decide what log aggregator use, and I don't have much time to test both. BTW, I'm running SLES 11 SP 2.

xfalcox 13y ago

Does this compare to logstash? I'm trying to decide what log aggregator use, and I don't have much time to test both. BTW, I'm running SLES 11 SP 2.

Don_E 13y ago

We are heavy users of both Graylog2 and Logstash and they both shine at different things at the moment. In an enterprise context with lots and lots of logs Graylog2 is making the process of segregating access to certain logs very,very easy. It's interface is a lot less "bling bling" than Kibana but much easier to use for a certain type of users. Logstash is still king for parsing logs into structured events (and we use it a LOT - our current config file is ~2.5k lines) but we had issues with stability and loosing messages (crashes due to character issues, etc). The core of Graylog2 rocks - it's stable and very performant (we are pushing 30k+ msgs/s over a single node with room to spare) and the support we have received from the Graylog2 team has been nothing but awesome. I am confident that they will catch up with Kibana (in terms of visualisations) very, very quickly.