docker-compose.yml

version: '3'
services:
# MongoDB: https://hub.docker.com/_/mongo/
  mongodb:
    hostname: "mongodb"
    image: "mongo"
    volumes:
      - mongodb:/data/db
      - mongodb:/data/configdb
      - mongodb:/data
    restart: "on-failure"
    networks:
      - graylog

  opensearch:
    image: "opensearchproject/opensearch:2.12.0"
    hostname: "elasticsearch"
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - "bootstrap.memory_lock=true"
      - "discovery.type=single-node"
      - "action.auto_create_index=false"
      - "plugins.security.ssl.http.enabled=false"
      - "plugins.security.disabled=true"
      # Can generate a password for `OPENSEARCH_INITIAL_ADMIN_PASSWORD` using a linux device via:
      # tr -dc A-Z-a-z-0-9_@#%^-_=+ < /dev/urandom  | head -c${1:-32}
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=+_8r#wliY3Pv5-HMIf4qzXImYzZf-M=M
    ulimits:
      memlock:
        hard: -1
        soft: -1
      nofile:
        soft: 65536
        hard: 65536
    restart: "on-failure"
    ports:
      - "9200:9200/tcp"
    volumes:
        - elasticsearch:/usr/share/elasticsearch/data
    networks:
        - graylog

  # Graylog: https://hub.docker.com/r/graylog/graylog/
  graylog:
    hostname: "server"
    image: "graylog/graylog:6.0"
    # To install Graylog Open: 
    depends_on:
      mongodb:
           condition: "service_started"
      opensearch:
           condition: "service_started"
    entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 --  /docker-entrypoint.sh
    environment:
    - GRAYLOG_NODE_ID_FILE=/usr/share/graylog/data/config/node-id
    - GRAYLOG_HTTP_BIND_ADDRESS=0.0.0.0:9000
    - GRAYLOG_ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    - GRAYLOG_MONGODB_URI=mongodb://mongodb:27017/graylog
    # To make reporting (headless_shell) work inside a Docker container
    - GRAYLOG_REPORT_DISABLE_SANDBOX=true
    # CHANGE ME (must be at least 16 characters)!
    - GRAYLOG_PASSWORD_SECRET=e61d91e23693869c9707c1955bc7e6b7654061f56e9cefa0c8ff20b3b98b7c85
    # Password: "admin"
    - GRAYLOG_ROOT_PASSWORD_SHA2=e61d91e23693869c9707c1955bc7e6b7654061f56e9cefa0c8ff20b3b98b7c85
    - GRAYLOG_HTTP_EXTERNAL_URI=http://0.0.0.0:9000/
    ports:
      # Graylog web interface and REST API
      - "9000:9000/tcp"
      # Beats
      - "5044:5044/tcp"
      # Raw TCP
      - "5140:5140/tcp"
      # Raw UDP
      - "5140:5140/udp"
      # SYSLOG TCP
      - "514:514/tcp"
      # Raw UDP
      - "514:514/udp"
      # GELF TCP
      - "12201:12201/tcp"
      # GELF UDP
      - "12201:12201/udp"
      # Forwarder data
      - "13301:13301/tcp"
      # Forwarder config
      - "13302:13302/tcp"
      # ElasticSearch    
    volumes:
          - graylog_data:/usr/share/graylog/data   
    networks:
      - graylog
    restart: "on-failure"

networks:
  graylog:
    driver: "bridge"


volumes:
  graylog_data:
    driver: local
  elasticsearch:
    driver: local
  mongodb:
    driver: local