How to Deploy Graylog with Docker and Integrate It into Spring Boot

In a micro‑service architecture each service runs multiple instances on different machines, making log collection difficult. Centralizing logs with a tool like Graylog solves this problem.

Deploy Graylog

Use Docker‑Compose. The following docker-compose.yml defines MongoDB, Elasticsearch and Graylog services. The only required change is the external IP/port.

version: '3'
services:
  mongo:
    image: mongo:4.2
    networks:
      - graylog
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Dlog4j2.formatMsgNoLookups=true -Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    deploy:
      resources:
        limits:
          memory: 1g
    networks:
      - graylog
  graylog:
    image: graylog/graylog:4.2
    environment:
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://ip:9009/
    entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 -- /docker-entrypoint.sh
    networks:
      - graylog
    restart: always
    depends_on:
      - mongo
      - elasticsearch
    ports:
      - 9009:9000
      - 1514:1514
      - 1514:1514/udp
      - 12201:12201
      - 12201:12201/udp
networks:
  graylog:
    driver: bridge

After adjusting the IP (port 9009 is used instead of the default 9000), run docker-compose up -d. Graylog becomes reachable at http://<ip>:9009/ with default credentials admin/admin.

Configure an input: select GELF UDP , give it a title and save.

Spring Boot Integration

Create a Spring Boot project (Logback is the default logger). Add the logback-gelf dependency:

<dependency>
  <groupId>de.siegmar</groupId>
  <artifactId>logback-gelf</artifactId>
  <version>3.0.0</version>
</dependency>

Add a logback.xml under src/main/resources with a GELF appender pointing to the Graylog host and port (default 12201). The configuration includes optional fields such as app_name, compression, and pattern layouts.

<appender name="GELF" class="de.siegmar.logbackgelf.GelfUdpAppender">
  <graylogHost>ip</graylogHost>
  <graylogPort>12201</graylogPort>
  <maxChunkSize>508</maxChunkSize>
  <useCompression>true</useCompression>
  <encoder class="de.siegmar.logbackgelf.GelfEncoder">
    <includeRawMessage>false</includeRawMessage>
    <includeMarker>true</includeMarker>
    <includeMdcData>true</includeMdcData>
    <includeCallerData>false</includeCallerData>
    <includeRootCauseData>false</includeRootCauseData>
    <includeLevelName>true</includeLevelName>
    <shortPatternLayout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%m%nopex</pattern>
    </shortPatternLayout>
    <fullPatternLayout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%d - [%thread] %-5level %logger{35} - %msg%n</pattern>
    </fullPatternLayout>
    <staticField>app_name:austin</staticField>
  </encoder>
</appender>

Replace the placeholder ip with your Graylog server address, then start the application. Logs will appear in Graylog’s Search view.

Click a log entry to view detailed fields.

Basic Log Search Syntax

Fuzzy query: type the term directly, e.g., orderid Exact query: wrap the term in quotes, e.g., "orderid: 11" Field query: message:http or message:"http" Multi‑field query: message:(base-service base-web) Combined conditions:

message:http AND level_name:ERROR OR source:192.168.0.4