example_graylog_docker-compose.yml

version: '3'
services:
    # MongoDB: https://hub.docker.com/_/mongo/
    mongo:
        image: mongo:4.2
        volumes:
            - mongo_data:/data/db
        networks:
            - graylog
    # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/7.10/docker.html
    elasticsearch:
        image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
        volumes:
            - es_data:/usr/share/elasticsearch/data
        environment:
            - http.host=0.0.0.0
            - transport.host=localhost
            - network.host=0.0.0.0
            - 'ES_JAVA_OPTS=-Xms512m -Xmx512m'
        ulimits:
            memlock:
                soft: -1
                hard: -1
        deploy:
            resources:
                limits:
                    memory: 1g
        networks:
            - graylog
    # Graylog: https://hub.docker.com/r/graylog/graylog/
    graylog:
        image: graylog/graylog:4.1.5
        environment:
            - GRAYLOG_PASSWORD_SECRET=${GRAYLOG_PASSWORD_SECRET}
            - GRAYLOG_ROOT_PASSWORD_SHA2=${GRAYLOG_ROOT_PASSWORD_SHA2}
            - GRAYLOG_HTTP_EXTERNAL_URI=${GRAYLOG_HTTP_EXTERNAL_URI}
        entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 --  /docker-entrypoint.sh
        networks:
            - graylog
        restart: always
        depends_on:
            - mongo
            - elasticsearch
        ports:
            # Graylog web interface and REST API
            - 9000:9000
            # Syslog TCP
            - 1514:1514
            # Syslog UDP
            - 1514:1514/udp
            # GELF TCP
            - 12201:12201
            # GELF UDP
            - 12201:12201/udp
            # Default Syslog TCP
            - 514:514
            # Default Syslog UDP
            - 514:514/udp
            # Custom TCP range
            - 601-610:601-610
            # Custom UDP range
            - 601-610:601-610/udp
        volumes: 
            - ./plugins:/usr/share/graylog/plugin
            - graylog_data:/usr/share/graylog/data

# Create networks
networks:
    graylog:
        driver: bridge

# Persist data in docker volumes
volumes:
    mongo_data:
        driver: local
    es_data:
        driver: local
    graylog_data:
        driver: local