The following article exclusively pertains to a Graylog Operations feature or functionality. To learn more about obtaining an Operations license, please contact the Graylog Sales team.

Reports allow you to combine multiple dashboard widgets to create a document that displays certain information contained within a Graylog system organized for specific purposes.

Hint: Reports are based on dashboard widgets, so ensure that you understand Dashboards before you start.

Creating Reports

Create a report on the “Operations/Reports” page in the web interface.

Click on the Create report button to get started. The page contains two different sections:

• Contents— Use the form to configure the report’s cover page, a short description, and select the widgets that will be part of the report.

• Report summary— Displays a summary of the report data. Summary information appears on the right side of the page and will follow as you scroll through the page.

When you are satisfied with the content, click on *Create report *to store that configuration in the database.

To change the selected contents of a report, go to the “Operations/Reports” page, and click on the Contents button for the report you wish to modify.

Report Contents

On the "New reports" page is a blank form that provides fields and an upload prompt to customize the report's contents.

Editing Report Attributes

When you create a new report, you can evaluate and edit attributes, such as dashboard, page, and widgets. Click the Edit icon to redirect to the related edit page.

Configure Reports

Hint: Time Zone Configuration: As of Graylog version 4.3 and later, you can customize reports to a specific timezone. Reports for earlier versions of Graylog are limited to reports built at the host location.

The Report Configuration page provides options to schedule the report for delivery and to configure the layout of the report.

Go to the “Operations/Reports” page, and click on Configuration to open the "Report Configuration" page.

Scheduling

Warning: Ensure the email configuration in your Graylog configuration file is working before you enable report scheduling.

Hint: Scheduling reports will use resources in the background on both the Graylog and ES clusters. To avoid performance issues, make sure to allocate enough resources for your setup, and disable the scheduling feature for non-automated reports.

In the scheduling section, configure how often the report will be sent (hourly, daily, weekly, or monthly).

You can add a subject and body to the email that will contain the report, and select Graylog users or external email addresses that will receive the report as email.

Once you update the information, make sure to click on Update scheduling to save your changes.

Layout

Much like in a dashboard, you can drag and drop widgets on the virtual sheet of paper to select the order in which widgets will appear in the report. The layout automatically saves the rearranged widgets.

Please note that the cover page is always the first page of the report, and the next page starts with the report description, followed by all widgets in their configured order.

History

As the background generation of reports may fail, the "Report History" page can uncover errors that occurred during report generation and the sending of a report in the background.

To open the "Report history" page for a report, click on the More actions button for that report, and select Report history.

Generating Report On Demand

Manual Download

To manually generate and download a report from the web interface, go to the “Operations/Reports” page, click on the More actions button for the report you want to download, and select Download report now.

Please take into account that the report generation may take a while.

Manually Send Report as Email

To manually generate and send the report, click on More actions and Send report now on the “Operations/Reports” page.