PlaybookAdd searchable dashboards with Graylog (Docker)
When to use this: Plain files are not enough and you want a web UI to search, filter and chart syslog.
Before you start
Steps
-
Download the official compose file
From Graylog's documentation, copy the Docker Compose example for the current release into a folder such as
~/graylog. Do not mix settings from different versions. -
Generate the secret and the admin password hash
terminalpwgen -N 1 -s 96 echo -n 'YourStrongPassword' | sha256sum | cut -d' ' -f1The first output is a long random string for the password secret. The second is the SHA-256 of your admin password. Put them in the compose settings the docs name (
GRAYLOG_PASSWORD_SECRETandGRAYLOG_ROOT_PASSWORD_SHA2). Installpwgenwithsudo apt install pwgenif missing. -
Publish a syslog port in the compose file
Under the Graylog service ports, add a syslog port such as
1514:1514/udpand1514:1514/tcp. Use 1514 instead of 514 so the container does not need privileged ports. Point devices at 1514, or forward 514 to 1514 with the host firewall. -
Start the stack
terminaldocker compose up -d docker compose logs -f graylogWait until Graylog reports it is running. The first start takes a few minutes.
-
Create the Syslog input
In the web UI: System, Inputs, choose 'Syslog UDP' (and 'Syslog TCP' if needed), bind to
0.0.0.0port 1514, Launch. Open the firewall for 1514 from your senders only. -
Point a device at it and search
Send a test message, then use Search. You should see parsed fields such as source and message. Add streams and dashboards for the logs you care about.
How to verify it worked
- Search shows messages arriving from the device, with the correct source IP and time.
How to undo it
Stop and remove the containers (add -v only if you also want to delete stored data):
docker compose downCommon errors and fixes
docker compose logs, compare with the official compose file and requirements. sudo tcpdump -ni any port 1514. Q&A
Is Graylog free?
Graylog Open is described by the vendor as free permanently. Paid Enterprise and Security editions exist. Check current terms.
Why use port 1514 instead of 514?
Ports below 1024 are privileged. Using 1514 avoids running containers with extra privileges, and you can redirect 514 to 1514 on the host if a device cannot change its port.