3

I'm trying to make a Graylog Docker Container persistent. Meaning that after restarting (docker-compose down; docker-compose up) the logs will still be there alongside the configuration. I've used the documentation at https://docs.graylog.org/en/3.1/pages/installation/docker.html I created a yml file with the content under the topic "Persisting data". I only edited the line "GRAYLOG_HTTP_EXTERNAL_URI=http://127.0.0.1:9000/" to not use localhost but the external ip the machine is using.

Docker works, i can create an input and collect logfiles. What does not work is the data being persistent. Also every time i restart the node id changes, so i have to reconfigure the input. Running docker volume ls lists five volumes 3 of which are the ones created in the yml file. I don't understand why data is not persistent. Can anybody help?

Christian Schmid
  • 31
  • 1
  • 2
  • Well that was fun. Spent an entire day setting up graylog for my homelab only to discover that everything was gone once I tried if it rebooted properly. Thats when I found this thread :-) – Robin van Baalen Jul 29 '21 at 21:48

2 Answers2

2

I had the same problem and I'd been struggling for a while before I found a solution. I'm on 3.2 and also had issues with node persistence. The documentation doesn't seem to directly state that there is one more configuration folder you need to persist, which is:

/usr/share/graylog/data/config

They actually mention it in the Custom configuration files section and when I took a look via CLI in that directory, it turns out that it's where the graylog.conf and node-id (the file Graylog uses to store information about its nodes) are stored as well!

Here's my docker-compose.override.yml section with the necessary changes (marked with '# ADDED' comments)

services:
  graylog:
    environment:
      # CHANGE ME (must be at least 16 characters)!
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      # Password: admin
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://127.0.0.1:9000/
      - GRAYLOG_IS_MASTER=true
      #- GRAYLOG_NODE_ID_FILE=/usr/share/graylog/data/config/node-id
    ports:
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 1514:1514
      # Syslog UDP
      - 1514:1514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp
    volumes:
      - "graylogjournal:/usr/share/graylog/data/journal"
      - "graylogconfig:/usr/share/graylog/data/config" # ADDED

volumes:
    graylogjournal:
      driver: local
    graylogconfig: # ADDED
      driver: local # ADDED

Hope this helps

Ch1mp
  • 45
  • 1
  • 8
  • The [Graylog 4 (+docker) docs](https://docs.graylog.org/en/4.0/pages/installation/docker.html) just put the entire "/usr/share/graylog/data" into a docker volume; look down in the "Persisting data" section. – Granger Feb 24 '21 at 17:01
0

You can add into daemon.json file these lines ;

{
  "log-driver": "gelf",
  "log-opts": {
    "gelf-address": "udp://1.2.3.4:12201"
  }
}

https://docs.docker.com/config/containers/logging/gelf/

muhammed ozbilici
  • 667
  • 6
  • 17