How to Install & Set Up Graylog

Deploy Graylog — centralized log management with search and alerting — using Docker Compose with MongoDB and OpenSearch.

Updated 20263-step setupDownload Graylog →

Prerequisites

✓A host with Docker and Docker Compose, 4 GB+ RAM
✓A generated password secret and admin password hash (commands below)

Generate the required secrets

terminal

# 96-char password secret:
openssl rand -base64 96 | tr -d '\n'; echo
# SHA-256 hash of your admin password:
echo -n "yourpassword" | sha256sum

Create docker-compose.yml

docker-compose.yml (abridged)

services:
  mongodb:
    image: mongo:6.0
    volumes: [mongodb_data:/data/db]
  opensearch:
    image: opensearchproject/opensearch:2
    environment:
      - discovery.type=single-node
      - plugins.security.disabled=true
      - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
    volumes: [os_data:/usr/share/opensearch/data]
  graylog:
    image: graylog/graylog:6.0
    environment:
      - GRAYLOG_PASSWORD_SECRET=PASTE_PASSWORD_SECRET
      - GRAYLOG_ROOT_PASSWORD_SHA2=PASTE_ADMIN_HASH
      - GRAYLOG_HTTP_EXTERNAL_URI=http://127.0.0.1:9000/
    ports: ["9000:9000", "12201:12201/udp"]
    depends_on: [mongodb, opensearch]
volumes: { mongodb_data: {}, os_data: {} }

Start and verify

Open http://localhost:9000 and log in as admin with the password you hashed above.

terminal

docker compose up -d

This entire stack is defined in the Compose file, so it runs the same on RHEL, Fedora, Debian, or Ubuntu — Graylog also publishes native .deb/.rpm packages if you'd rather avoid Docker, documented on its own install page.

Documentation & Knowledge Base

Official DocumentationGraylog Documentation →Knowledge Base & CommunityGraylog Community →

Download Graylog— all versions & official links→

Need Graylog deployed and managed for you?

We're OpenStack Dev — we design, deploy, and operate production DevOps infrastructure.

Get in Touch All Install Guides