How to Deploy Graylog with Docker Compose: An Efficient Logging Solution

X (Twitter) Facebook Pinterest LinkedIn

Graylog is an open-source log management tool with a centralized platform for storing, searching, and analyzing large volumes of machine-generated logs. It’s designed to help developers and system administrators monitor the health and performance of their systems in real-time. Deploying Graylog using Docker Compose can significantly simplify the setup process, making it accessible for individuals and teams looking to implement robust logging solutions. This guide will walk you through the steps to deploy Graylog, MongoDB, and Elasticsearch with Docker Compose.

Table of Contents

Prerequisites

Before starting, ensure you have:

Docker installed on your system.
Docker Compose installed on your system.
Basic familiarity with Docker and Docker Compose concepts.

Step 1: Create a Docker Compose File

Create a directory dedicated to your Graylog setup. This directory will contain your Docker Compose file (docker-compose.yml) and any additional configuration files.

mkdir graylog-docker && cd graylog-docker

Create the docker-compose.yml file:

touch docker-compose.yml

Open the file in a text editor and add the following configuration:

version: '3'
services:
  mongodb:
    image: mongo:4.2
    container_name: mongodb
    volumes:
      - mongo_data:/data/db
    networks:
      - graylog

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
    container_name: elasticsearch
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - es_data:/usr/share/elasticsearch/data
    networks:
      - graylog

  graylog:
    image: graylog/graylog:4.0
    container_name: graylog
    environment:
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      - GRAYLOG_ROOT_PASSWORD_SHA2=yourpasswordhash
      - GRAYLOG_HTTP_EXTERNAL_URI=http://127.0.0.1:9000/
    depends_on:
      - mongodb
      - elasticsearch
    ports:
      - "9000:9000"
      - "12201:12201"
      - "1514:1514"
    networks:
      - graylog

networks:
  graylog:
    driver: bridge

volumes:
  mongo_data:
  es_data:

Configuration Details:

MongoDB: Graylog uses MongoDB to store configuration and meta-information.
Elasticsearch: Serves as the search engine for log data storage and retrieval. Adjust the ES_JAVA_OPTS environment variable according to your system’s available memory.
Graylog: The main Graylog instance. Replace somepasswordpepper and yourpasswordhash with your actual password secret and the SHA2 hash of your root password. Use an online tool or the echo -n yourpassword | shasum -a 256 command to generate the SHA2 hash.
Networks: Defines a custom network graylog for inter-service communication.
Volumes: Persist data for MongoDB and Elasticsearch to ensure data retention across container restarts.

Step 2: Launch the Services

Navigate to the directory containing your docker-compose.yml file and start the services by running:

docker compose up -d

This command will download the necessary images and start the containers in detached mode.

Step 3: Access Graylog

After the services have started, open a web browser and navigate to http://localhost:9000 to access the Graylog web interface. Log in with the username admin and the root password you set earlier.

Step 4: Configure Graylog

Once logged in, you can start configuring Graylog to receive logs. This typically involves setting up input sources under System/Inputs, defining extractors or pipelines for log processing, and creating dashboards for monitoring.

Conclusion

Deploying Graylog with Docker Compose offers a streamlined approach to setting up a comprehensive log management solution. Following the steps outlined in this guide, you can have a Graylog instance up and running, ready to centralize and analyze your system logs. Docker Compose simplifies the management of Graylog and its dependencies, making it an excellent choice for teams looking to implement effective logging practices with minimal setup complexity.

Author
Recent Posts

Follow me

Anastasios Antoniadis

Anastasios Antoniadis is the founder and editor-in-chief of BORDERPOLAR... He is a software engineer, blogger, and avid gamer covering tech, gaming, and coding guides for over 4 years. He is a 2014 graduate of the Department of Informatics and Telecommunications of the University of Athens, an M.Sc. holder in Computer Science, and a Ph.D. student in Program Analysis.