Upgrading to Graylog 4.3.x
  • 19 Sep 2022
  • 1 Minute to read
  • Dark
    Light

Upgrading to Graylog 4.3.x

  • Dark
    Light

Installing Graylog 4.3.x

For the links to the most recent Graylog releases, visit the Releases section of the Graylog Blog!

Warning

Please make sure to create a MongoDB database backup before starting the upgrade to Graylog 4.3.

For full installation procedures, including methods of installation and configuration options, please review the Installing Graylog user guide.

4.3.x Compatibility

Elasticsearch Version Compatibility

GRAYLOG VERSIONMINIMUM ES VERSIONMAXIMUM ES VERSION
4.3.x6.8 to 7.10.27.10.2

MongoDB Version Compatibility

GRAYLOG VERSION
MINIMUM MONGO VERSION
MAXIMUM MONGO VERSION
4.3.x3.64.4

Notable API Endpoint Changes

EndpointDescription
GET /api/system/configurationThe field stale_master_timeout has been deprecated. It is still present in the response object for backwards compatibility but will hold the same value as the new stale_leader_timeout field, which has been added as a replacement.

Removed Migrations

  • Removed two migrations that convert pre-1.2 user permissions and index ranges to newer formats.
  • Removed a migration that was recalculating the index ranges of the default stream's index set for pre 2.2 Graylog installations.

Configuration File Changes

OptionActionDescription
is_masterremovedReplaced with is_leader. For backwards compatibility, is_master will still be evaluated, but is_leader takes precedence, if both are configured.
stale_master_timeoutremovedReplaced with stale_leader_timeout. For backwards compatibility, stale_master_timeout will still be evaluated, but stale_leader_timeout takes precedence, if both are configured.
index_field_type_periodical_intervalremovedTo control index field type refreshing, the new index_field_type_periodical_full_refresh_interval may be used instead.
is_leaderaddedReplacement for is_master to promote inclusive naming.
stale_leader_timeoutaddedReplacement for stale_master_timeout to promote inclusive naming.
index_field_type_periodical_full_refresh_intervaladdedAllows users to tweak the default interval after which field type information will be refreshed for all indices.

Behaviour Changes

  • Pipeline function drop_message was modified to provide more performant and
    predictable results: When drop_message is called in a rule, we complete processing of
    the current stage; following stages are skipped. Other pipelines operating on the same message will
    complete stage numbers less than or equal to the aborting stage; higher numbered stages are skipped.
  • The key_value pipeline function was improved to handle quoted values. This can result in different (but now correct) parsing results when quoted values include the key-value separator. (see graylog2-server#11738)
  • Restarting the server would restart all inputs, even those that were manually stopped.
    We now persist the desired input state: manually stopped inputs remain stopped, even after a server restart.
    Users can choose the legacy behaviour by setting a flag in the graylog.conf:
    auto_restart_inputs = true

Was this article helpful?