Graylog
Graylog Open collects, indexes, and searches logs, with dashboards and alerts. Includes MongoDB and OpenSearch.
Deploy Graylog on Dokploy
- Install Dokploy on your server if you haven't already.
- In your Dokploy panel, open a project and click Create Service → Template.
- Search for Graylog and click Create — Dokploy configures domains, environment variables, and volumes for you.
Alternatively, create a Compose service, go to Advanced → Import from Base64, and paste this payload:
ewogICJjb21wb3NlIjogInNlcnZpY2VzOlxuICBncmF5bG9nOlxuICAgIGltYWdlOiBncmF5bG9nL2dyYXlsb2c6Ny4xLjlcbiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZFxuICAgIGRlcGVuZHNfb246XG4gICAgICBtb25nb2RiOlxuICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeVxuICAgICAgb3BlbnNlYXJjaDpcbiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHlcbiAgICBlbnRyeXBvaW50OlxuICAgICAgLSAvdXNyL2Jpbi90aW5pXG4gICAgICAtIC0tXG4gICAgICAtIC9iaW4vYmFzaFxuICAgICAgLSAtZWNcbiAgICAgIC0gfFxuICAgICAgICBleHBvcnQgR1JBWUxPR19ST09UX1BBU1NXT1JEX1NIQTI9XCIkJChwcmludGYgJyVzJyBcIiQkR1JBWUxPR19BRE1JTl9QQVNTV09SRFwiIHwgc2hhMjU2c3VtIHwgY3V0IC1kICcgJyAtZiAxKVwiXG4gICAgICAgIHVuc2V0IEdSQVlMT0dfQURNSU5fUEFTU1dPUkRcbiAgICAgICAgZXhlYyAvZG9ja2VyLWVudHJ5cG9pbnQuc2hcbiAgICBlbnZpcm9ubWVudDpcbiAgICAgIEdSQVlMT0dfQURNSU5fUEFTU1dPUkQ6ICR7R1JBWUxPR19BRE1JTl9QQVNTV09SRDo/U2V0IHRoZSBhZG1pbiBwYXNzd29yZH1cbiAgICAgIEdSQVlMT0dfUEFTU1dPUkRfU0VDUkVUOiAke0dSQVlMT0dfUEFTU1dPUkRfU0VDUkVUOj9TZXQgdGhlIHBhc3N3b3JkIHNlY3JldH1cbiAgICAgIEdSQVlMT0dfSFRUUF9CSU5EX0FERFJFU1M6IDAuMC4wLjA6OTAwMFxuICAgICAgR1JBWUxPR19IVFRQX0VYVEVSTkFMX1VSSTogJHtHUkFZTE9HX0hUVFBfRVhURVJOQUxfVVJJOj9TZXQgdGhlIHB1YmxpYyBVUkwgaW5jbHVkaW5nIGl0cyB0cmFpbGluZyBzbGFzaH1cbiAgICAgIEdSQVlMT0dfTU9OR09EQl9VUkk6IG1vbmdvZGI6Ly9tb25nb2RiOjI3MDE3L2dyYXlsb2dcbiAgICAgIEdSQVlMT0dfRUxBU1RJQ1NFQVJDSF9IT1NUUzogaHR0cDovL29wZW5zZWFyY2g6OTIwMFxuICAgICAgR1JBWUxPR19OT0RFX0lEX0ZJTEU6IC91c3Ivc2hhcmUvZ3JheWxvZy9kYXRhL2RhdGEvbm9kZS1pZFxuICAgICAgR1JBWUxPR19TRVJWRVJfSkFWQV9PUFRTOiAtWG1zNTEybSAtWG14NTEybVxuICAgIGV4cG9zZTpcbiAgICAgIC0gXCI5MDAwXCJcbiAgICAgIC0gXCIxMjIwMS90Y3BcIlxuICAgICAgLSBcIjEyMjAxL3VkcFwiXG4gICAgdm9sdW1lczpcbiAgICAgIC0gZ3JheWxvZy1kYXRhOi91c3Ivc2hhcmUvZ3JheWxvZy9kYXRhXG4gICAgaGVhbHRoY2hlY2s6XG4gICAgICB0ZXN0OiBbXCJDTURcIiwgXCJjdXJsXCIsIFwiLWZzU1wiLCBcImh0dHA6Ly8xMjcuMC4wLjE6OTAwMC9hcGkvc3lzdGVtL2xic3RhdHVzXCJdXG4gICAgICBpbnRlcnZhbDogMzBzXG4gICAgICB0aW1lb3V0OiA1c1xuICAgICAgcmV0cmllczogNVxuICAgICAgc3RhcnRfcGVyaW9kOiAxMjBzXG5cbiAgbW9uZ29kYjpcbiAgICBpbWFnZTogbW9uZ286OC4wLjI5XG4gICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWRcbiAgICBjb21tYW5kOiBbXCJtb25nb2RcIiwgXCItLXdpcmVkVGlnZXJDYWNoZVNpemVHQlwiLCBcIjAuMjVcIl1cbiAgICB2b2x1bWVzOlxuICAgICAgLSBtb25nb2RiLWRhdGE6L2RhdGEvZGJcbiAgICAgIC0gbW9uZ29kYi1jb25maWc6L2RhdGEvY29uZmlnZGJcbiAgICBoZWFsdGhjaGVjazpcbiAgICAgIHRlc3Q6IFtcIkNNRFwiLCBcIm1vbmdvc2hcIiwgXCItLXF1aWV0XCIsIFwiLS1ldmFsXCIsIFwicXVpdChkYi5hZG1pbkNvbW1hbmQoJ3BpbmcnKS5vayA/IDAgOiAxKVwiXVxuICAgICAgaW50ZXJ2YWw6IDMwc1xuICAgICAgdGltZW91dDogMTBzXG4gICAgICByZXRyaWVzOiA1XG4gICAgICBzdGFydF9wZXJpb2Q6IDMwc1xuXG4gIG9wZW5zZWFyY2g6XG4gICAgaW1hZ2U6IG9wZW5zZWFyY2hwcm9qZWN0L29wZW5zZWFyY2g6Mi4xOS41XG4gICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWRcbiAgICBlbnZpcm9ubWVudDpcbiAgICAgIGRpc2NvdmVyeS50eXBlOiBzaW5nbGUtbm9kZVxuICAgICAgYWN0aW9uLmF1dG9fY3JlYXRlX2luZGV4OiBcImZhbHNlXCJcbiAgICAgIGJvb3RzdHJhcC5tZW1vcnlfbG9jazogXCJ0cnVlXCJcbiAgICAgIE9QRU5TRUFSQ0hfSkFWQV9PUFRTOiAtWG1zNTEybSAtWG14NTEybVxuICAgICAgRElTQUJMRV9JTlNUQUxMX0RFTU9fQ09ORklHOiBcInRydWVcIlxuICAgICAgRElTQUJMRV9TRUNVUklUWV9QTFVHSU46IFwidHJ1ZVwiXG4gICAgdWxpbWl0czpcbiAgICAgIG1lbWxvY2s6XG4gICAgICAgIHNvZnQ6IC0xXG4gICAgICAgIGhhcmQ6IC0xXG4gICAgICBub2ZpbGU6XG4gICAgICAgIHNvZnQ6IDY1NTM2XG4gICAgICAgIGhhcmQ6IDY1NTM2XG4gICAgdm9sdW1lczpcbiAgICAgIC0gb3BlbnNlYXJjaC1kYXRhOi91c3Ivc2hhcmUvb3BlbnNlYXJjaC9kYXRhXG4gICAgaGVhbHRoY2hlY2s6XG4gICAgICB0ZXN0OiBbXCJDTURcIiwgXCJjdXJsXCIsIFwiLWZzU1wiLCBcImh0dHA6Ly8xMjcuMC4wLjE6OTIwMC9fY2x1c3Rlci9oZWFsdGg/d2FpdF9mb3Jfc3RhdHVzPXllbGxvdyZ0aW1lb3V0PTVzXCJdXG4gICAgICBpbnRlcnZhbDogMzBzXG4gICAgICB0aW1lb3V0OiAxMHNcbiAgICAgIHJldHJpZXM6IDVcbiAgICAgIHN0YXJ0X3BlcmlvZDogNjBzXG5cbnZvbHVtZXM6XG4gIGdyYXlsb2ctZGF0YTpcbiAgbW9uZ29kYi1kYXRhOlxuICBtb25nb2RiLWNvbmZpZzpcbiAgb3BlbnNlYXJjaC1kYXRhOiIsCiAgImNvbmZpZyI6ICJbdmFyaWFibGVzXVxubWFpbl9kb21haW4gPSBcIiR7ZG9tYWlufVwiXG5hZG1pbl9wYXNzd29yZCA9IFwiJHtwYXNzd29yZDozMn1cIlxucGFzc3dvcmRfc2VjcmV0ID0gXCIke3Bhc3N3b3JkOjk2fVwiXG5cbltjb25maWddXG5lbnYgPSBbXG4gIFwiR1JBWUxPR19BRE1JTl9QQVNTV09SRD0ke2FkbWluX3Bhc3N3b3JkfVwiLFxuICBcIkdSQVlMT0dfUEFTU1dPUkRfU0VDUkVUPSR7cGFzc3dvcmRfc2VjcmV0fVwiLFxuICBcIkdSQVlMT0dfSFRUUF9FWFRFUk5BTF9VUkk9aHR0cDovLyR7bWFpbl9kb21haW59L1wiXG5dXG5tb3VudHMgPSBbXVxuXG5bW2NvbmZpZy5kb21haW5zXV1cbnNlcnZpY2VOYW1lID0gXCJncmF5bG9nXCJcbnBvcnQgPSA5MDAwXG5ob3N0ID0gXCIke21haW5fZG9tYWlufVwiIgp9
Configuration
The exact Docker Compose and template configuration this template deploys.
Instructions
Graylog
This template runs Graylog Open with MongoDB and self-managed OpenSearch. It uses the normal Graylog login without Data Node's preflight setup.
Before deploying
- Use an x86-64 server with AVX support for MongoDB.
- Allow at least 3 GiB of available RAM for a small installation. Graylog and OpenSearch each start with a 512 MiB Java heap. Increase their heap settings and MongoDB's cache for larger workloads.
- Set
vm.max_map_countto at least262144on the Docker host. For example, runsudo sysctl -w vm.max_map_count=262144and persist the setting in/etc/sysctl.d/99-graylog.conf. - Keep Dokploy's isolated deployment enabled. MongoDB and OpenSearch have no authentication and must stay on the private application network. Do not publish their ports.
Login
Open the domain assigned by Dokploy. Use username admin and the generated GRAYLOG_ADMIN_PASSWORD from the service's Environment tab. The startup command hashes this password for Graylog.
When enabling HTTPS or changing the domain in Dokploy, update GRAYLOG_HTTP_EXTERNAL_URI to the matching URL, including the trailing slash, and redeploy. Enable HTTPS before sending credentials over an untrusted network.
Keep GRAYLOG_PASSWORD_SECRET unchanged after deployment. Graylog uses it to encrypt stored credentials.
Receive logs
Create an input under System > Inputs. For GELF, select GELF UDP or GELF TCP, bind to 0.0.0.0, and use port 12201.
The template does not publish host ports. To accept logs from outside the application network, add the required port mapping to the graylog service in Dokploy's Compose editor and redeploy. For GELF UDP:
yaml
For GELF TCP, use 12201:12201/tcp. Choose an unused host port and restrict access to trusted log senders in your firewall. Creating an input and publishing its port are both required. HTTP domain routing does not forward TCP or UDP inputs.
Data and upgrades
Named volumes store MongoDB configuration, indexed logs, Graylog's node ID, and its message journal. Preserve all four volumes when redeploying or upgrading, and back up MongoDB and OpenSearch together with Graylog's configuration.
Check the Graylog compatibility matrix before changing image versions. OpenSearch 3.x is not supported by this Graylog version.
Related Templates
HyperDX
Version: 2.38.0
HyperDX searches and visualizes logs, traces, metrics, and session replays. Includes ClickHouse, MongoDB, and the ClickStack OpenTelemetry collector.
Parseable
Version: v1.6.5
Fast observability and log analytics platform on object storage
Seq
Version: 2025.2
Seq is a self-hosted search, analysis, and alerting server for structured application logs and events.
Agent DVR
Version: latest
Agent DVR is a comprehensive video surveillance software with motion detection, alerts, and remote access capabilities.
Beszel
Version: 0.10.2
A lightweight server monitoring hub with historical data, docker stats, and alerts.
Change Detection
Version: 0.49
Changedetection.io is an intelligent tool designed to monitor changes on websites. Perfect for smart shoppers, data journalists, research engineers, data scientists, and security researchers.
Self-host Graylog in minutes
Dokploy is a free, open source deployment platform. Deploy Graylog and 567+ other templates on your own infrastructure with a single click.