Greylog + filebeat

Table Of Contents

1 MUST-HAVE

2 MUST-PREPARE

3- INSTALL GRAYLOG USING DOCKER COMPOSE

1 MUST-HAVE

2 MUST PREPARE

create a new folder named “graylog” in /home
$ sudo mkdir -p /graylog/{mongodb,elasticsearch,graylog}
$ mkdir -p /graylog/graylog/config
$ cd /graylog/graylog/config
$ wget https://raw.githubusercontent.com/Graylog2/graylog-docker/4.0/config/graylog.conf
$ wget https://raw.githubusercontent.com/Graylog2/graylog-docker/4.0/config/log4j2.xml
$ sudo chown 1100:1100 -R /srv/graylog
- GRAYLOG_HTTP_EXTERNAL_URI=http://12.0.4.188:9000/ 
- GRAYLOG_ELASTICSEARCH_HOSTS=http://12.0.4.188:9200
- GRAYLOG_HTTP_EXTERNAL_URI=http://localhost:9000/ 
- GRAYLOG_ELASTICSEARCH_HOSTS=http://localhost:9200
$ echo -n “mypassword” | sha256sum
89e01536ac207279409d4de1e5253e01f4a1769e696db0d6062ca9b8f56767c8 -
root_password_sha2 = 89e01536ac207279409d4de1e5253e01f4a1769e696db0d6062ca9b8f56767c8

3 INSTALL GRAYLOG USING DOCKER COMPOSE

volumes: 
- /home/graylog/graylog:/usr/share/graylog/data
volumes:
- /home/graylog/elasticsearch:/usr/share/elastisearch/data
volumes:
- /home/graylog/mongodb:/data/db
version: '3' 

services:
# MongoDB: https://hub.docker.com/_/mongo/
mongo:
image: mongo:4.2
container_name: mongodb
volumes:
- /home/graylog/mongodb:/data/db
networks:
- graylog

#elasticsearch
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.0
container_name: elasticsearch
environment:
- http.host=0.0.0.0
- transport.host=localhost
- network.host=0.0.0.0
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
volumes:
- /home/graylog/elasticsearch:/usr/share/elastisearch/data
ulimits:
memlock:
soft: -1
hard: -1
deploy:
resources:
limits:
memory: 1g
ports:
- 9200:9200
networks:
- graylog

# Graylog: https://hub.docker.com/r/graylog/graylog/
graylog:
image: graylog/graylog:4.0
container_name: graylog
environment:
- GRAYLOG_HTTP_EXTERNAL_URI=http://12.0.4.188:9000/
- GRAYLOG_ELASTICSEARCH_HOSTS=http://12.0.4.188:9200
- GRAYLOG_ELASTICSEARCH_VERSION=7
volumes:
- /home/graylog/graylog:/usr/share/graylog/data
networks:
- graylog
restart: always
depends_on:
- mongo
- elasticsearch
ports:
# Graylog web interface and REST API
- 9000:9000
# Syslog TCP
- 514:1514
# Syslog UDP
- 514:1514/udp
# GELF TCP
- 12201:12201

networks:
graylog:

4 Start services

docker-compose up -d 

--

--

Devops software engineer

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store