How to Deploy Graylog with Docker and Integrate It into Spring Boot

In a micro‑service architecture each service may have many instances spread across different machines, making log collection difficult. Aggregating logs into a single place solves this problem, and Graylog is a popular tool for that purpose.

Deploy Graylog

Use a docker-compose.yml file (based on the official example) to start MongoDB, Elasticsearch, and Graylog containers. The only required change is to replace the placeholder ip with the actual host IP and, if needed, adjust the external port from 9000 to 9009.

version: '3'
services:
  mongo:
    image: mongo:4.2
    networks:
      - graylog
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Dlog4j2.formatMsgNoLookups=true -Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    networks:
      - graylog
  graylog:
    image: graylog/graylog:4.2
    environment:
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://<strong>ip</strong>:9009/
    entrypoint: /usr/bin/tini --wait-for-elasticsearch:9200 -- /docker-entrypoint.sh
    networks:
      - graylog
    restart: always
    depends_on:
      - mongo
      - elasticsearch
    ports:
      - 9009:9000
      - 1514:1514
      - 1514:1514/udp
      - 12201:12201
      - 12201:12201/udp
networks:
  graylog:
    driver: bridge

Run docker-compose up -d to start the stack, then open http://<ip>:9009 (default credentials admin/admin) to access the Graylog UI.

In the UI, create a new GELF UDP input by clicking “Launch new input”, fill in the Title, and save.

Spring Boot Integration

Create a Spring Boot project (Logback is the default logger). Add the logback-gelf dependency:

<dependency>
  <groupId>de.siegmar</groupId>
  <artifactId>logback-gelf</artifactId>
  <version>3.0.0</version>
</dependency>

Add a logback.xml file under src/main/resources with the following configuration (replace ip with the Graylog host address):

<appender name="GELF" class="de.siegmar.logbackgelf.GelfUdpAppender">
  <graylogHost>ip</graylogHost>
  <graylogPort>12201</graylogPort>
  <maxChunkSize>508</maxChunkSize>
  <useCompression>true</useCompression>
  <encoder class="de.siegmar.logbackgelf.GelfEncoder">
    <includeRawMessage>false</includeRawMessage>
    <includeMarker>true</includeMarker>
    <includeMdcData>true</includeMdcData>
    <includeCallerData>false</includeCallerData>
    <includeRootCauseData>false</includeRootCauseData>
    <includeLevelName>true</includeLevelName>
    <shortPatternLayout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%m%nopex</pattern>
    </shortPatternLayout>
    <fullPatternLayout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%d - [%thread] %-5level %logger{35} - %msg%n</pattern>
    </fullPatternLayout>
    <staticField>app_name:austin</staticField>
  </encoder>
</appender>

Start the Spring Boot application; its logs will now appear in Graylog. In the Graylog “Search” view you can see the collected log entries.

Typical Graylog search syntax includes:

Fuzzy query: orderid Exact query: "orderid: 11" Field query: message:http or message:"http" Multi‑field query: message:(base-service base-web) Complex query: message:http AND level_name:ERROR OR source:192.168.0.4 For more advanced configuration, refer to the GitHub documentation of the logback-gelf component.