How to Deploy Graylog with Docker‑Compose and Integrate It into Spring Boot

In a micro‑service architecture each service runs multiple instances that may be spread across different machines or containers, making log inspection difficult because logs are scattered.

Deploy Graylog

Use Docker‑Compose to launch Graylog, MongoDB and Elasticsearch. The docker‑compose.yml file is as follows:

version: '3'
services:
  mongo:
    image: mongo:4.2
    networks:
      - graylog
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - ES_JAVA_OPTS=-Dlog4j2.formatMsgNoLookups=true -Xms512m -Xmx512m
    ulimits:
      memlock:
        soft:-1
        hard:-1
    deploy:
      resources:
        limits:
          memory:1g
    networks:
      - graylog
  graylog:
    image: graylog/graylog:4.2
    environment:
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://<ip>:9009/
      # replace <ip> with your server address
    entrypoint: /usr/bin/tini -- wait-for-elasticsearch:9200 -- /docker-entrypoint.sh
    networks:
      - graylog
    restart: always
    depends_on:
      - mongo
      - elasticsearch
    ports:
      - 9009:9000
      - 1514:1514
      - 1514:1514/udp
      - 12201:12201
      - 12201:12201/udp
networks:
  graylog:
    driver: bridge

Modify only the IP address (and optionally the external port) in the file, then run docker-compose up -d. After the containers start, access the Graylog web UI at http://<ip>:9009/ using the default credentials admin/admin .

Configure an input: go to GELF UDP , click “Launch new input”, fill in the Title and save.

Spring Boot Integration with Graylog

Create a Spring Boot project (which uses Logback by default) and add the Logback‑GELF dependency:

<dependency>
  <groupId>de.siegmar</groupId>
  <artifactId>logback-gelf</artifactId>
  <version>3.0.0</version>
</dependency>

Add a logback.xml file under src/main/resources with the following configuration (replace ip with your Graylog address):

<appender name="GELF" class="de.siegmar.logbackgelf.GelfUdpAppender">
  <graylogHost>ip</graylogHost>
  <graylogPort>12201</graylogPort>
  <maxChunkSize>508</maxChunkSize>
  <useCompression>true</useCompression>
  <encoder class="de.siegmar.logbackgelf.GelfEncoder">
    <includeRawMessage>false</includeRawMessage>
    <includeMarker>true</includeMarker>
    <includeMdcData>true</includeMdcData>
    <includeCallerData>false</includeCallerData>
    <includeRootCauseData>false</includeRootCauseData>
    <includeLevelName>true</includeLevelName>
    <shortPatternLayout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%m%nopex</pattern>
    </shortPatternLayout>
    <fullPatternLayout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%d - [%thread] %-5level %logger{35} - %msg%n</pattern>
    </fullPatternLayout>
    <staticField>app_name:austin</staticField>
  </encoder>
</appender>

After restarting the Spring Boot application, logs appear in Graylog’s Search view. You can expand a log entry to see detailed fields.

Typical Graylog query syntax includes fuzzy search, exact match, field‑specific queries, multi‑field queries, and boolean expressions, e.g.:

orderid

"orderid: 11"

message:http or message:"http"

message:(base-service base-web)

message:http AND level_name:ERROR OR source:192.168.0.4

Refer to the component’s GitHub documentation for advanced configuration options.