Graylog Docker Setup (Development)

Description

This repository provides a Docker-based Graylog setup for local development and testing environments.

Setup

1. Initialize environment variables

cp .env.example .env

2. Start the stack

Run the following command to start Graylog and its dependencies (MongoDB, Elasticsearch, etc.)

docker compose up -d

3. Configure log inputs

Once Graylog is running, set up the following inputs in the Graylog Web UI:

◉ SYSLOG UDP — Port 1514

allow_override_date: true
bind_address: 0.0.0.0
charset_name: UTF-8
expand_structured_data: false
force_rdns: false
number_worker_threads: 1
override_source: <empty>
port: 1514
recv_buffer_size: 1048576
store_full_message: false
timezone: UTC

◉ GELF UDP — Port 12201

bind_address: 0.0.0.0
charset_name: UTF-8
decompress_size_limit: 8388608
number_worker_threads: 4
override_source: <empty>
port: 12201
recv_buffer_size: 262144

※ Start inputs.