Deploying Graylog with Docker Compose and Integrating it into a Spring Boot Application

In microservice architectures, logs are scattered across multiple instances, making troubleshooting difficult; the article introduces Graylog as a log aggregation solution and demonstrates how to deploy it using Docker Compose.

version: '3'
services:
    mongo:
      image: mongo:4.2
      networks:
        - graylog
    elasticsearch:
      image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
      environment:
        - http.host=0.0.0.0
        - transport.host=localhost
        - network.host=0.0.0.0
        - "ES_JAVA_OPTS=-Dlog4j2.formatMsgNoLookups=true -Xms512m -Xmx512m"
      ulimits:
        memlock:
          soft: -1
          hard: -1
      deploy:
        resources:
          limits:
            memory: 1g
      networks:
        - graylog
    graylog:
      image: graylog/graylog:4.2
      environment:
        - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
        - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
        - GRAYLOG_HTTP_EXTERNAL_URI=http://ip:9009/ # modify IP
      entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 -- /docker-entrypoint.sh
      networks:
        - graylog
      restart: always
      depends_on:
        - mongo
        - elasticsearch
      ports:
        - 9009:9000
        - 1514:1514
        - 1514:1514/udp
        - 12201:12201
        - 12201:12201/udp
networks:
  graylog:
    driver: bridge

After adjusting the IP address and port (e.g., changing the default 9000 to 9009), the stack can be started with docker-compose up -d , and the Graylog web interface is accessible via the specified IP and port using the default credentials admin/admin.

The guide then shows how to configure a Spring Boot project to send logs to Graylog. First, add the Logback GELF dependency:

<dependency>
  <groupId>de.siegmar</groupId>
  <artifactId>logback-gelf</artifactId>
  <version>3.0.0</version>
</dependency>

Next, create a logback.xml file in the resources directory with a GELF UDP appender, configuring the Graylog host, port, and other options such as chunk size, compression, and pattern layouts. The only required change is the ip of the Graylog server.

<appender name="GELF" class="de.siegmar.logbackgelf.GelfUdpAppender">
  <!-- Graylog server address -->
  <graylogHost>ip</graylogHost>
  <!-- UDP input port -->
  <graylogPort>12201</graylogPort>
  <!-- Max GELF chunk size (bytes) -->
  <maxChunkSize>508</maxChunkSize>
  <!-- Use compression -->
  <useCompression>true</useCompression>
  <encoder class="de.siegmar.logbackgelf.GelfEncoder">
    <includeRawMessage>false</includeRawMessage>
    <includeMarker>true</includeMarker>
    <includeMdcData>true</includeMdcData>
    <includeCallerData>false</includeCallerData>
    <includeRootCauseData>false</includeRootCauseData>
    <includeLevelName>true</includeLevelName>
    <shortPatternLayout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%m%nopex</pattern>
    </shortPatternLayout>
    <fullPatternLayout class="ch.qos.logback.classic.PatternLayout">
      <pattern>%d - [%thread] %-5level %logger{35} - %msg%n</pattern>
    </fullPatternLayout>
    <staticField>app_name:austin</staticField>
  </encoder>
</appender>

After rebuilding and running the Spring Boot application, logs appear in Graylog’s Search view. The article demonstrates how to expand a log entry to see detailed fields and provides examples of search queries, including fuzzy search, exact match, field-specific, multi-field, and combined condition queries.

Finally, the author promotes additional PDF resources on Spring Cloud, Spring Boot, and MyBatis, and encourages readers to like, share, and follow the public account for more content.