graylog/graylog-enterprise repository overview

⁠Graylog Enterprise Docker Image

The latest stable version of Graylog is 7.0.6.

⁠What is Graylog?

Graylog is a centralized logging solution that enables aggregating and searching through logs. It provides a powerful query language, a processing pipeline for data transformation, alerting abilities, and much more. It is fully extensible through a REST API. Add-ons can be downloaded from the Graylog Marketplace⁠.

⁠Image Details

This is the Graylog Enterprise⁠ image. It contains Graylog⁠, the Graylog Enterprise⁠ plugin, the Integrations⁠ plugin, and the Enterprise Integrations plugin.

There are images for the linux/amd64 and linux/arm64 platforms available. All images are based on the latest Eclipse Temurin image⁠ (JRE + Ubuntu LTS variant) available at build time.

⁠Architecture

Take a look at the minimal Graylog architecture⁠ to get the big picture of a Graylog setup. In essence, Graylog needs to talk to MongoDB to store configuration data and OpenSearch to store the actual log data.

⁠Configuration

Please refer to the Graylog Docker documentation⁠ for a comprehensive overview and detailed description of the Graylog Docker image.

If you want to quickly spin up an instance for testing, you can use our Docker Compose template⁠.

Notably, this image requires that two important configuration options be set (although in practice, you will likely need to set more):

1. password_secret (environment variable GRAYLOG_PASSWORD_SECRET)
   • A secret that is used for password encryption and salting.
   • There must be at least 16 characters, but using 64 characters is strongly recommended.
   • Must be the same on all Graylog nodes in the cluster.
   • May be generated with something like: pwgen -N 1 -s 96
2. root_password_sha2 (environment variable GRAYLOG_ROOT_PASSWORD_SHA2)
   • A SHA2 hash of a password you will use for your initial login as Graylog's root user.
     • The default username is admin. This value is customizable via the configuration option root_username (environment variable GRAYLOG_ROOT_USERNAME).
   • In general, these credentials will only be needed to set up the system initially or reconfigure it in case of an authentication backend failure.
   • This password cannot be changed using the API or via the Web interface.
   • May be generated with something like: echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1

Every Graylog configuration option⁠ can be set via an environment variable. To get the environment variable name for a given configuration option, simply prefix the option name with GRAYLOG_ and put it all in upper case. Another option is to store the configuration file outside of the container and edit it directly.

This image includes the wait-for-it⁠ script, which allows you to have Docker wait for OpenSearch to start up before starting Graylog. For example, if you are using Docker Compose you could override the entry point for Graylog like this:

entrypoint: /usr/bin/tini -- wait-for-it opensearch:9200 -- /docker-entrypoint.sh

⁠Documentation

Documentation for Graylog is hosted here⁠. Please review the docs and familiarize yourself with the functionality before opening an issue on GitHub⁠.

⁠License

See the Graylog Enterprise License and Support Agreement⁠.

This Docker image is licensed under the Apache 2.0 license, see LICENSE⁠.