docker-compose.yml

# Image versions of the containers have to be manually edited once a new version is available

version: '3.7'
services:

  # MongoDB: https://hub.docker.com/_/mongo/
  mongo:
    image: mongo:4.4.19
    volumes:
      - mongo_data:/data/db
    networks:
      - graylog
    restart: always

  elasticsearch: # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/7.10/docker.html
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2

     # Stores ElasticSearch data in this directory/path. Comes in handy when updating ElasticSearch, so that data is retained.
    volumes:
      - es_data:/usr/share/elasticsearch/data
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms512m -Xmx1g" # `Xms` specifies the minimum memory allocation pool. `Xmx` specifies the maximum allocation pool for the Java Virtual Machine (JVM).
    ulimits:
      memlock:
        soft: -1
        hard: -1
    networks:
      - graylog
    restart: always

  graylog:   # Graylog: https://hub.docker.com/r/graylog/graylog/
    image: graylog/graylog:4.3.15
    volumes:
      - graylog_data:/usr/share/graylog/data # Stores Graylog data in this directory/path. Comes in handy when updating Graylog, so that data is retained.
    environment:
      - GRAYLOG_PASSWORD_SECRET=${GRAYLOG_PASSWORD_SECRET} # Change this value in the .env file

      - GRAYLOG_ROOT_PASSWORD_SHA2=${GRAYLOG_ROOT_PASSWORD_SHA2} # Change this value in the .env file

      - GRAYLOG_HTTP_EXTERNAL_URI=${GRAYLOG_HTTP_EXTERNAL_URI} # Change this value in the .env file

    # Sets the correct timezone within Graylog
      - TZ=Europe/Amsterdam
      - GRAYLOG_TIMEZONE=Europe/Amsterdam
      - GRAYLOG_ROOT_TIMEZONE=Europe/Amsterdam
    entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 --  /docker-entrypoint.sh
    networks:
      - graylog

    # Links MongoDB with ElasticSearch.
    links:
      - mongo:mongodb
      - elasticsearch
    restart: always

    #Doesn't work without MongoDB and ElasticSearch.
    depends_on:
      - mongo
      - elasticsearch
    ports:
      - 5044:5044/udp       # Beats UDP
      - 5044:5044/tcp       # Beats TCP
      - 9000:9000           # Graylog web interface and REST API
      - 1514:1514/udp       # Syslog UDP
      - 5555:5555/tcp       # Raw/Plaintext TCP input
networks:
    graylog:
      driver: bridge

# Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/
volumes:
  mongo_data:
    driver: local
  es_data:
    driver: local
  graylog_data:
    driver: local