Content Packs
  • 23 Sep 2021
  • 3 Minutes to read
  • Dark

Content Packs

  • Dark

What are content packs?

Content packs are a convenient way to share configuration. A content pack is aJSON file which contains a set of configurations of Graylog components.This JSON file can be uploaded to Graylog instances and then installed.A user who took the time to create a input, pipelines and dashboard for acertain type of log format, can so easily share their efforts with the community.

Content packs can be found on the Graylog Marketplace.

Content packs in 3.0 have changed fundamentally from previousversions. Graylog will try to support older versions in thefuture, but at this point there is no guarantee that oldercontent packs still work.


Content packs can have parameters. Those parameters help to adjust theconfiguration to the needs of the user. A good example usage is the port ofan input. The creator of the content pack may have their input running on port55055, but the user of the content pack may already have an input running onthat specific port.The creator can specify a parameter and assign it to the port.The user of the content pack will be asked for a value of the parameter oninstallation. The provided value will then be used as the port of the input onthe new system.

How do I create a Content Pack?

  1. Navigate to System / Content Packs.
  2. Click on Create a Content Pack on the upper right side of the page.A new content pack is created in a wizard. On the left sideof that page is the navigation of the wizard. There are 3 steps tocontent pack creation: Content Selection, Parameters and Preview.In the middle part of the page is the form of each wizard step. And on theright side is the summary of the content pack in creation.


  1. Fill out the general information of the content pack.
  2. The Content Selection offers configurations which can be included to thecontent pack. Necessary dependencies will be included automatically.

The one exception to this rule is dependencies for pipelinerules. Currently, grok patterns and lookup tables for pipelinerules must be added manually to the content pack. Support forautomatic inclusion of pipeline rule dependencies will beadded in a future release.

  1. Click on Next or Parameter to go the Parameter Page.Parameter are placeholders which will be filled out during installationof a content pack. That way, parts of the configuration may be adjustedaccording to the needs of the user.To create a parameter click on Create Parameter. In the opening modalcan the name, type and default value of the parameter be specified. Graylogsupports four types of configuration values: String, Integer, Doubleand Boolean.


  1. The created parameter can be assigned to a configuration key bypressing Edit on one of the previously selected configurationsunder Entity List.
  2. The final step of creation can be reached by clicking on Next orPreview.On the preview page displays a summary of the new content pack.This page is meant for a final close inspection of the content packbefore creation.
  3. To finish the creation click on Create or Create and Download.

Upload a content pack

Content packs may be downloaded at theGraylog Marketplace .To upload these content packs navigate to System / Content Packs and click on Upload. The now showing modal has a file finder to selectthe downloaded content pack. Click on Upload to finish the process.The uploaded content pack may now be installed on the new Graylog system.

Installing a content pack

To install the newest version of a content pack, navigate toSystem / Content Packs. This page shows the list of uploaded and created content packs.By clicking Install on the desired content pack, a modal will openwhich will ask for a Install Comment and the values of the parameters.It also shows the list of configurations that will be installed on thesystem. Click on Install to complete the installation.


Some entities need a unique title or name (e.g Lookup Table).When installing such an entity and the title is alreadypresent on the system, then Graylog will use the installedentity instead of installing a new one. Even when thenew configuration differs from the already installed one.

Uninstalling a content pack

Navigate to System / Content Packs and click on the name of the contentpack that should be uninstalled.The displayed page shows the details of a uploaded or created content pack.


On the left, select the version of the content pack.Below that is a list of installations of that content pack.Click Uninstall next to the desired installation.A list of entities about to be removed will be displayed.

Was this article helpful?