How to Centralize Spring Boot Logs with Graylog Using Docker Compose

1. Graylog Overview

Graylog is a production‑grade log collection system that stores metadata in MongoDB and log data in Elasticsearch.

The architecture diagram and a production deployment diagram illustrate the components.

2. Install Graylog

Use Docker‑Compose to launch Graylog, MongoDB, and Elasticsearch. Below is a simplified docker-compose.yml:

version: '2'
services:
  mongodb:
    image: mongo
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.6.1
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms256m -Xmx256m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    mem_limit: 512m
  graylog:
    image: graylog/graylog:3.0
    environment:
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://<your_ip>:9000/
    links:
      - mongodb:mongo
      - elasticsearch:elasticsearch
    depends_on:
      - mongodb
      - elasticsearch
    ports:
      - 9000:9000   # Graylog web UI & REST API
      - 1514:1514   # Syslog TCP
      - 1514:1514/udp   # Syslog UDP
      - 12201:12201   # GELF TCP
      - 12201:12201/udp   # GELF UDP

Replace <your_ip> with your external IP (e.g., 106.13.35.42) or use 127.0.0.1 for local testing.

3. Configure Graylog

Open a browser at http://<your_ip>:9000. The default credentials are admin / admin. Create an input (e.g., GELF UDP) via the System → Inputs page and launch it.

After saving, the input is ready to receive logs.

4. Send Spring Boot Logs to Graylog

4.1 Logback Example

Add the logback-gelf dependency to your pom.xml:

<dependency>
  <groupId>de.siegmar</groupId>
  <artifactId>logback-gelf</artifactId>
  <version>2.0.0</version>
</dependency>

Create logback-spring.xml:

<configuration>
  <conversionRule conversionWord="clr" converterClass="org.springframework.boot.logging.logback.ColorConverter"/>
  <property name="CONSOLE_LOG_PATTERN" value="${CONSOLE_LOG_PATTERN:-%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(${LOG_LEVEL_PATTERN:-%5p}) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}}"/>
  <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
    <encoder>
      <pattern>${CONSOLE_LOG_PATTERN}</pattern>
      <charset>UTF-8</charset>
    </encoder>
  </appender>
  <appender name="GELF" class="de.siegmar.logbackgelf.GelfUdpAppender">
    <graylogHost>106.13.35.42</graylogHost>
    <graylogPort>12201</graylogPort>
  </appender>
  <root level="info">
    <appender-ref ref="GELF"/>
    <appender-ref ref="STDOUT"/>
  </root>
</configuration>

Run the Spring Boot application (default port 8081). Logs appear in Graylog:

4.2 Log4j2 Example

Add the log4j2-gelf dependency:

<dependency>
  <groupId>org.graylog2.log4j2</groupId>
  <artifactId>log4j2-gelf</artifactId>
  <version>1.3.1</version>
</dependency>

Create log4j2-spring.xml:

<Configuration status="OFF" packages="org.graylog2.log4j2">
  <Properties>
    <Property name="LOG_PATTERN">%d{yyyy-MM-dd HH:mm:ss:SSS} - %-5level - %pid - %t - %c{1.}:%L - %m%n</Property>
  </Properties>
  <Appenders>
    <Console name="Console" target="SYSTEM_OUT" follow="true">
      <ThresholdFilter level="trace" onMatch="ACCEPT" onMismatch="DENY"/>
      <PatternLayout pattern="${LOG_PATTERN}"/>
    </Console>
    <GELF name="gelfAppender" server="106.13.35.42" port="12201" hostName="appserver01.example.com">
      <PatternLayout pattern="%logger{36} - %msg%n"/>
      <Filters>
        <Filter type="MarkerFilter" marker="FLOW" onMatch="DENY" onMismatch="NEUTRAL"/>
        <Filter type="MarkerFilter" marker="EXCEPTION" onMatch="DENY" onMismatch="ACCEPT"/>
      </Filters>
    </GELF>
  </Appenders>
  <Loggers>
    <Root level="info">
      <AppenderRef ref="gelfAppender"/>
      <AppenderRef ref="Console"/>
    </Root>
  </Loggers>
</Configuration>

The application runs on port 8888, and logs are visible in Graylog:

5. ELK vs Graylog

Both are log‑collection solutions. Choose based on existing stack: if you already use MongoDB, Graylog may reduce cost; otherwise ELK is a solid alternative. Avoid choosing a stack solely for hype.

6. Source Code

Git repositories:

springboot2_graylog

springboot2_graylog_log4j