---
title: "How to Centralize Log Management with Graylog Docker"
description: "Learn how to centralize log management with Graylog using Docker for efficient data analysis in this tutorial!"
canonical: "https://adamtheautomator.com/graylog-docker/"
---

# How to Centralize Log Management with Graylog Docker

> Learn how to centralize log management with Graylog using Docker for efficient data analysis in this tutorial!

Source: https://adamtheautomator.com/graylog-docker/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![How to Centralize Log Management with Graylog Docker](https://adamtheautomator.com/wp-content/uploads/2022/02/How-to-Centralize-Log-Management-with-Graylog-Using-Docker.jpg)

# How to Centralize Log Management with Graylog Docker

[![](https://secure.gravatar.com/avatar/ff757e22f03c8a84ce8a2b8f87c53481ba627afec8bd1c8fda5c576097ea027c?s=192&d=mm&r=g)Joseph Eshiett](https://adamtheautomator.com/author/joseph-eshiett/)14 February 20227 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[Docker](/tag/docker/)[Docker-Compose](/tag/docker-compose/)[Ubuntu Linux](/tag/ubuntu-linux/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [Deploying Graylog Using Docker Compose](#deploying-graylog-using-docker-compose)
*   [Changing Index Shards Value for ElasticSearch](#changing-index-shards-value-for-elasticsearch)
*   [Setting up Graylog to Collect Logs from Syslog](#setting-up-graylog-to-collect-logs-from-syslog)
*   [Configuring Rsyslog to Send Syslog Data to Graylog](#configuring-rsyslog-to-send-syslog-data-to-graylog)
*   [Conclusion](#conclusion)

Are you seeking a system that can interpret your log files, store them in a secure environment, and collect well-organized data for analysis? Well, centralizing log management with Graylog Docker could be what you’re looking for!

In this tutorial, you’ll learn how to use Graylog and Docker to construct a centralized log system for collecting Syslog data from your Ubuntu machine.

Read on and start centralizing your log management!

## Prerequisites

This post will be a step-by-step tutorial. To follow along, be sure to have the following:

*   Two Ubuntu machines (one host and one client) – This tutorial uses [Ubuntu 20.04](https://adamtheautomator.com/install-ubuntu/), but other Linux distros will work.

Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/)

*   [**Rsyslog**](https://www.rsyslog.com/ubuntu-repository/) on the client machine.
    
*   Docker installed on the host machine. The version of Docker used for this tutorial is 20.10.7
    

Related:[How to Install and Use Docker on Ubuntu (In the Real World)](https://adamtheautomator.com/docker-ubuntu/)

*   [Docker-compose](https://docs.docker.com/compose/install/) installed on the host machine.

Related:[Everything You Need to Know about Using Docker Compose](https://adamtheautomator.com/docker-compose-tutorial/)

*   [Pwgen utility](https://howtoinstall.co/en/pwgen) needs to be installed on the host machine to generate a random secret password.

## Deploying Graylog Using Docker Compose

What is Graylog anyway? Graylog is an open-source log management platform. Graylog can gather, index, and analyze structured and unstructured data from sources. One of these sources is operating systems in real-time.

Before deploying Graylog, you’ll first need to install Graylog on your host machine using Docker Compose.

> Suppose _you’re using a cloud-based Ubuntu 20.04 computer. In that case, you’ll need to modify your security group or firewall rules to allow the following ports: `1514` and `12201` for both TCP and UDP connections and `9000` for only TCP connections._

Related:[How to Set up an Azure Firewall (And Why Not NSGS)](https://adamtheautomator.com/azure-firewall/)

1\. Open your favorite SSH client, and connect to your machine.

2\. Next, run the below commands to create a new directory in your home directory and switch to that directory. You can name the directory as you prefer. But for this demo, the directory is called _~/graylog._

```bash
mkdir graylog
cd graylog
```

3\. Create a YAML file named _docker-compose.yml_ in your _~/graylog_ directory, then populate the file with the configuration below. But don’t save the changes yet. To protect the Graylog login and restrict access to your data, you’ll need to generate a secret password.

In the newly created file, you will find the configuration for setting up Graylog, MongoDB, and ElasticSearch components. Graylog requires all of these components set up and run simultaneously for Graylog to function effectively.

```yaml
version: '2'
services:
  # MongoDB: https://hub.docker.com/_/mongo/
  MongoDB: # Mongodb service
    image: mongo:4.2 # Version of Mongodb docker image 
    volumes:
      - mongo_data:/data/db # Persisted mongodb data
  # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/7.10/docker.html
  elasticsearch: # ElasticSearch service
		
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2 # Version of elasticsearch image
    volumes:
      - es_data:/usr/share/elasticsearch/data # Persisted elasticsearch data 
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      # Unlimited amount of memory set for elasticsearch container
      memlock:
        soft: -1
        hard: -1
		# Resource limit for elasticsearch set to 1 gigabyte
    mem_limit: 1g
  # Graylog: https://hub.docker.com/r/graylog/graylog/
  graylog:
    image: graylog/graylog:4.2 # Version of Graylog docker image
    volumes:
      - graylog_data:/usr/share/graylog/data # Persisted Graylog data
    environment:
      # CHANGE ME (must be at least 16 characters)!
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      # Password: admin
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://127.0.0.1:9000/
      - GRAYLOG_WEB_ENDPOINT_URI=http://127.0.0.1:9000/api
		# Command to run as soon as components are started
    entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 --  /docker-entrypoint.sh
		# Containers that Graylog depends on 
    links:
      - mongodb:mongo
      - elasticsearch
    restart: always # Graylog container set to always restart when stopped
    depends_on:
      - mongodb
      - elasticsearch
    ports:
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 1514:1514
      # Syslog UDP
      - 1514:1514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp
# Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/
volumes:
  mongo_data:
    driver: local
  es_data:
    driver: local
  graylog_data:
    driver: local
```

4\. Now, run the `pwgen` command below to generate a single random password (`-N`) with 96 (`-s 96`) characters.

```bash
pwgen -N 1 -s 96
```

5\. Your generated secret password will look similar to the one below. Note your secret password as you’ll set it in the _docker-compose.yml_ file (step six).

![Generating a Secret Password](https://adamtheautomator.com/wp-content/uploads/2022/02/image-150.png)

Generating a Secret Password

6\. Go back to the _docker-compose.yml_ file and replace `somepasswordpepper` in `GRAYLOG_PASSWORD_SECRET` with your newly generated secret password (step five). You’ll use this password for password encryption and salting. Without this secret password, the Graylog container will not start.

7\. Run the command below to generate a SHA2 hash of a password of your choosing. This password is required for the initial log-in to Graylog.

```bash
echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
```

Enter an admin password of your choice when prompted, as shown below, and hit ENTER. Once you’ve entered a password, your hashed password generates.

Note your hashed password as you’ll set it in the _docker-compose.yml_ file (step eight).

![Generating Hashed Password](https://adamtheautomator.com/wp-content/uploads/2022/02/image-151.png)

Generating Hashed Password

8\. Replace the value of the `GRAYLOG_ROOT_PASSWORD_SHA2` environment variable in the _docker-compose.yml_ file with the SHA2 hash password you previously generated (step seven). Save the changes in the _docker-compose.yml_ file and exit the editor.

9\. Finally, run the [`docker-compose up`](https://docs.docker.com/compose/reference/up/) command below to deploy [ElasticSearch](https://www.elastic.co/what-is/elasticsearch), [MongoDB](https://www.mongodb.com/what-is-mongodb), and [Graylog](https://www.graylog.org/about) Docker containers in detached mode (`-d`). This command pulls them from the Docker hub and starts them as containers for Graylog to work correctly.

```bash
# Starting up MongoDB, ElasticSearch, and Graylog containers in detached mode
sudo docker-compose up -d
```

The image below shows that the MongoDB, ElasticSearch, and Graylog Docker images have been pulled from the Docker hub and started as containers.

![Deploying Graylog in Detached Mode](https://adamtheautomator.com/wp-content/uploads/2022/02/image-152.png)

Deploying Graylog in Detached Mode

## Changing Index Shards Value for ElasticSearch

You’ve just deployed Graylog, and that’s a big step forward in centralizing log management. But now, it’s time to configure Graylog. You’ll change the ElasticSearch [shards](https://qbox.io/blog/optimizing-elasticsearch-how-many-shards-per-index) value depending on how many ElasticSearch nodes/containers you’re running.

> _A shard is a unit at which Elasticsearch distributes data around multiple nodes. The optimal number of shards per node is one._

1\. Open your favorite web browser and navigate to _https://<HOST\_IP>:9000_, where _HOST\_IP_ is your host machine’s IP address. If all goes well, you’ll get to the Graylog’s login screen shown below.

Enter **admin** as the username, and enter the admin password you created in the “Deploying Graylog Using Docker Compose” section (step seven). For this tutorial, the password is adamtheautomator.

![Accessing Graylog’s Login Screen ](https://adamtheautomator.com/wp-content/uploads/2022/02/image-153.png)

Accessing Graylog’s Login Screen

After logging in, you’ll see Graylog’s Getting Started page, as shown below.

![Viewing Graylog’s Getting Started Page](https://adamtheautomator.com/wp-content/uploads/2022/02/image-154.png)

Viewing Graylog’s Getting Started Page

2\. Next, click on the **System** menu —> **Indices**, as shown below, to access the **Indices & Index** page (step three), where you can choose to edit the default index set.

![Accessing Indices & Index Sets Page](https://adamtheautomator.com/wp-content/uploads/2022/02/image-155.png)

Accessing Indices & Index Sets Page

3\. Click on **Edit** to manage Graylog’s default index set and change the ElasticSearch [shard](https://qbox.io/blog/optimizing-elasticsearch-how-many-shards-per-index) value. The default value for ElasticSearch shards is four, and you’ll need to change that (step four)_._

![Accessing the Configure Index Set Page for Default Index Set](https://adamtheautomator.com/wp-content/uploads/2022/02/image-156.png)

Accessing the Configure Index Set Page for Default Index Set

4\. Finally, change the number of ElasticSearch shards to one (**1**) as you’re running only a single ElasticSearch node/container, and click on **Save** at the bottom of the page.

![Changing Index Shards Value to 1](https://adamtheautomator.com/wp-content/uploads/2022/02/image-157.png)

Changing Index Shards Value to 1

## Setting up Graylog to Collect Logs from Syslog

You’ve just configured Graylog by changing the value for Index shards for ElasticSearch. But you’ll also need to set up Graylog to collect log data from Syslog in the client machine. How? You’ll set up Graylog inputs to receive log data sent from your client machine via Syslog for parsing in the host machine.

With Syslog as a standard network-based logging protocol, you can transport your client machine’s event messages or log data to Graylog.

1\. Click on the **System** menu —> **Inputs** to access the **Inputs** page, where you’ll set up a Syslog UDP input.

![Accessing Inputs page to set up new Syslog UDP input](https://adamtheautomator.com/wp-content/uploads/2022/02/image-158.png)

Accessing Inputs page to set up new Syslog UDP input

2\. Search for and select **Syslog UDP** in the search box, as shown below, then click on **Launch new input**.

![Searching for and selecting Syslog UDP input](https://adamtheautomator.com/wp-content/uploads/2022/02/image-159.png)

Searching for and selecting Syslog UDP input

3\. Lastly, configure the new **Syslog UDP input** with the following, and click on **Save** at the bottom of the pop-up window to keep and apply the changes:

*   Select your node from the **Node** drop-down box.
*   Set the **Title** to any word you wish. For this demo, the title is **syslog**.
*   Set the **Bind address** to **0.0.0.0,** so Graylog can listen to incoming events anywhere.
*   Set the **Port** to the Syslog UDP port `1514` as defined in the _docker-compose.yml_ file under `Syslog UDP`.

![Configuring new Syslog UDP input ](https://adamtheautomator.com/wp-content/uploads/2022/02/image-160.png)

Configuring new Syslog UDP input

Below, you’ll see the Syslog UDP input is running as part of **Local inputs** after configuration.

![Verifying Syslog UDP input is Running](https://adamtheautomator.com/wp-content/uploads/2022/02/image-161.png)

Verifying Syslog UDP input is Running

## Configuring Rsyslog to Send Syslog Data to Graylog

You’ve set up a Syslog UDP input to receive data sent from your client machine, but how do you send the data to Graylog? [Rsyslog](https://www.rsyslog.com/) will do the trick!

You’ll create a configuration file for Rsyslog to push your Syslog data from your client machine to Graylog running in your host machine.

1\. Create a configuration file in the _/etc/rsyslog.d_ directory on your client machine. You can name the file as you prefer, but the file is called _90-graylog.conf for this demo._

2\. Next, add the following line to the _90-graylog.conf_ file, save the changes and close the editor. Replace `34.76.103.44` with your host machine’s IP address where Graylog is running.

The below configuration sends Syslog data (`RSYSLOG_SyslogProtocol23Format`) from the host machine (`@34.76.103.44`) to Graylog.

```powershell
*.* @34.76.103.44:1514;RSYSLOG_SyslogProtocol23Format
```

3\. Run the below command to restart `rsyslog` for the changes to take effect.

```bash
sudo systemctl restart rsyslog
```

Related:[Controlling Systemd services with Ubuntu systemctl](https://adamtheautomator.com/ubuntu-systemctl/)

4\. Switch back to the Graylog web interface and click on the **Search** menu to see your Syslog data collected neatly parsed similarly to the one below.

![Verifying Syslog data sent successfully to Graylog](https://adamtheautomator.com/wp-content/uploads/2022/02/image-162.png)

Verifying Syslog data sent successfully to Graylog

## Conclusion

In this tutorial, you’ve learned to create your own centralized log management system with Graylog using Docker and verified successfully collected Syslog data from your client machine.

At this point, you’ve realized collecting and storing well-organized data in a secure environment for analysis will not be a pain anymore.

What other logs can you collect with Graylog? Perhaps set up a web host to send NGINX logs to Graylog for further parsing and analysis?

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fgraylog-docker%2F&text=How%20to%20Centralize%20Log%20Management%20with%20Graylog%20Docker)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fgraylog-docker%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fgraylog-docker%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2022/05/The-Essential-Guide-to-Grafana-Docker-Monitoring.jpg)

### [The Essential Guide to Grafana Docker Monitoring](/grafana-docker/)

Learn the essentials of monitoring your Docker runtime using Prometheus along with Grafana Docker containers in this ATA Learning tutorial!

![](https://adamtheautomator.com/wp-content/uploads/2022/02/Deploy-a-Production-Docker-MariaDB-Installation.jpg)

### [MariaDB Docker Effortless Deployment](/docker-mariadb/)

Learn how to deploy a production Docker for your MariaDB installation without messing things up on your system in this step-by-step tutorial!

![](https://adamtheautomator.com/wp-content/uploads/2022/02/How-to-Create-a-Private-Docker-Registry-on-Ubuntu-Linux.jpg)

### [How to Create a Private Docker Registry on Ubuntu Linux](/private-docker-registry/)

Learn how to create and host your own private Docker registry in this how-to tutorial!

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)