Install Graylog 5 with docker compose¶

docker版本：20.10.24
Graylog版本：5.1.6
Opensearch版本¹：2.4.0
MongoDB版本：5.0.20

由於官方範本 裡docker-compose.yml的指定版本較高，而原先主機上的docker-compose版本還停留在version 1.21.2，無法執行這份定義檔，因此需改用較高版本的 docker compose 來執行，做法是替主機上的docker 加裝plugin、讓docker指令直接支援 compose V2

[root@host ~]# yum install docker-compose-plugin
[root@host ~]# docker compose version

Docker Compose version v2.21.0

預先建立graylog所需的admin登入密碼，稍後會填入 .env檔案中的 GRAYLOG_ROOT_PASSWORD_SHA2值

[root@host ~]# echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
Enter Password:

預先建立gralog所需的金鑰，稍後會填入 .env檔案中的 GRAYLOG_PASSWORD_SECRET值

[root@host ~]# pwgen -N 1 -s 96

按照官方範本，需要設定docker-compose.yml與 .env這兩個檔案

docker-compose.yml

version: "3.8"

services:
  mongodb:
    container_name: graylog-mongodb
    hostname: graylog-mongodb
    image: "mongo:5.0.20"
    volumes:
      - ./mongodb_data:/data/db
    restart: "on-failure"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "10"
    networks:
      - graylog-network

  opensearch:
    image: "opensearchproject/opensearch:2.4.0"
    container_name: graylog-opensearch
    hostname: graylog-opensearch
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - "bootstrap.memory_lock=true"
      - "discovery.type=single-node"
      - "action.auto_create_index=false"
      - "plugins.security.ssl.http.enabled=false"
      - "plugins.security.disabled=true"
    ulimits:
      memlock:
        hard: -1
        soft: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - ./os_data:/usr/share/opensearch/data
    restart: "on-failure"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "10"
    networks:
      - graylog-network

  graylog:
    image: "${GRAYLOG_IMAGE:-graylog/graylog:5.0}"
    container_name: graylog
    hostname: graylog
    depends_on:
      opensearch:
        condition: "service_started"
      mongodb:
        condition: "service_started"
    entrypoint: "/usr/bin/tini -- wait-for-it opensearch:9200 --  /docker-entrypoint.sh"
    environment:
      GRAYLOG_NODE_ID_FILE: "/usr/share/graylog/data/config/node-id"
      GRAYLOG_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:?Please configure GRAYLOG_PASSWORD_SECRET in the .env file}"
      GRAYLOG_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:?Please configure GRAYLOG_ROOT_PASSWORD_SHA2 in the .env file}"
      GRAYLOG_HTTP_BIND_ADDRESS: "0.0.0.0:9000"
      GRAYLOG_HTTP_EXTERNAL_URI: "http://localhost:9000/"
      GRAYLOG_ELASTICSEARCH_HOSTS: "http://graylog-opensearch:9200"
      GRAYLOG_MONGODB_URI: "mongodb://graylog-mongodb:27017/graylog"
      GRAYLOG_ROOT_TIMEZONE: "Asia/Taipei"   #User admin Timezone
      TZ: "Asia/Taipei"   #Graylog server Timezone
      #NOeffect
      #ROOT_TIMEZONE: "Asia/Taipei"
      #GRAYLOG_TIMEZONE: "Asia/Taipei"

      GRAYLOG_TRANSPORT_EMAIL_PROTOCOL: 'smtp'
      GRAYLOG_TRANSPORT_EMAIL_ENABLED: 'true'
      GRAYLOG_TRANSPORT_EMAIL_PORT: 587
      GRAYLOG_TRANSPORT_EMAIL_HOSTNAME: smtp.gmail.com
      GRAYLOG_TRANSPORT_EMAIL_USE_AUTH: 'true'
      GRAYLOG_TRANSPORT_EMAIL_USE_TLS: 'true'
      GRAYLOG_TRANSPORT_EMAIL_USE_SSL: 'false'
      GRAYLOG_TRANSPORT_EMAIL_AUTH_USERNAME: 'test@gmail.com'
      GRAYLOG_TRANSPORT_EMAIL_AUTH_PASSWORD: 'xxxxxxxxxxxxxxxx'
      GRAYLOG_TRANSPORT_EMAIL_FROM_EMAIL: 'test@gmail.com'

    ports:
    - "5044:5044/tcp"   # Beats
    - "5140:5140/udp"   # Syslog
    - "5140:5140/tcp"   # Syslog
    - "5555:5555/tcp"   # RAW TCP
    - "5555:5555/udp"   # RAW TCP
    - "9000:9000/tcp"   # Server API
    - "12201:12201/tcp" # GELF TCP
    - "12201:12201/udp" # GELF UDP
    - "13301:13301/tcp" # Forwarder data
    - "13302:13302/tcp" # Forwarder config
    volumes:
      - ./graylog_data:/usr/share/graylog/data/data
      - ./graylog_journal:/usr/share/graylog/data/journal
    restart: "on-failure"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "10"
    networks:
      - graylog-network

networks:
  graylog-network:
    external: false

.env

#You MUST set a secret to secure/pepper the stored user passwords here. Use at least 64 characters.
# Generate one by using for example: pwgen -N 1 -s 96
# ATTENTION: This value must be the same on all Graylog nodes in the cluster.
# Changing this value after installation will render all user sessions and encrypted values in the database invalid. (e.g. encrypted access tokens)
GRAYLOG_PASSWORD_SECRET="xxxxxxxx"

# You MUST specify a hash password for the root user (which you only need to initially set up the
# system and in case you lose connectivity to your authentication backend)
# This password cannot be changed using the API or via the web interface. If you need to change it,
# modify it in this file.
# Create one by using for example: echo -n yourpassword | shasum -a 256
# and put the resulting hash value into the following line
# CHANGE THIS!
GRAYLOG_ROOT_PASSWORD_SHA2="xxxxxxxx"

GRAYLOG_IMAGE="graylog/graylog:5.1.6"

預先建立 volume 要使用的目錄並給予對應權限，graylog 和 opensearch 的 container 才跑得起來

[root@host ~]# mkdir graylog_data graylog_journal os_data
[root@host ~]# chown -R 1100:1100 ./graylog_data
[root@host ~]# chown -R 1100:1100 ./graylog_journal
[root@host ~]# chown -R 1000:1000 ./os_data

容器跑起來！

[root@host ~]# docker compose up -d

Reference¶