Migrating saved searches to another server

1. Describe your incident:

I have deployed a new Graylog instance and I would like to find a way to migrate the saved searches (~200 of them!) from the old server into the new one.

2. Describe your environment:

  • OS Information: Ubuntu 20.04 LTS

  • Package Version:
    Old server: Graylog 3.2.6
    New server: Graylog 4.3.3

3. What steps have you already taken to try and solve the problem?

I managed to export all the saved searches via Graylog’s API by running:

curl -i -u esj91grt4a4utjnfomptcg08jtq68ghvvohpd1gdl7fgq44617e:token -H 'Accept: application/json' -X GET 'https://old-graylog-server.tld:443/api/views/savedSearches?pretty=true' --insecure > graylog-oldserver-saved-searches.json

but cannot find a way to import them in the new server.

4. How can the community help?

I would like to know if such task is actually possible. I also read that their format may vary between Graylog versions…



If your referring to Save search ( settings)? Then MongoDb is the place to be. Execute a mongodump. then SCP to new instance done.

If you referring to Data the Elasticsearch is the place to be, this would need to be. Execute a repo and move it to the new instance.

You may want to look here. Also there are a few demos in the forum on the “HowTo” /w ES and Mongo migration

Last, Migration of a widget, dashboard, etc… I would create a Content Pack. Download it and then Upload the Content Pack to the new server.


I was referring to the “saved searches” you can find here:


Is mongodump capable of only dumping that data? if I proceed as you suggest “1. mongodump, 2. scp to the new server”, I’d overwrite the contents of the current MongoDB and that’s something I’d like to avoid… otherwise, I must re-configure a lot of things…

Open to suggestions…


Replying to myself: creating a content pack with the searches did the trick!

  1. create a content pack with the saved searches

  2. download the resulting JSON file

  3. import it in the new GL server

Thanks !

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.