docker-compose.yml

version: '2.1'

networks:
  graylog.net:
    enable_ipv6: false
    ipam:
      driver: default
      config:
        - subnet: 10.10.10.0/24

volumes:
  graylog.data.es1:
    driver: "local"
  graylog.data.es2:
    driver: "local"
  graylog.data.mongo:
    driver: "local"
  graylog.data.mongoclient:
    driver: "local"
  graylog.data.gl1.journal:
    driver: "local"
  graylog.data.gl2.journal:
    driver: "local"


services:
  nginx:
    image: nginx:alpine
    container_name: nginx
    hostname: nginx
    mem_limit: 128m
    restart: always
    environment:
      - TZ=Europe/Berlin
    ports:
      - 192.168.1.50:80:80
      - 192.168.1.50:443:443
    volumes:
      - ./nginx/root:/usr/share/nginx/html:ro
      - ./nginx/config/conf.d:/etc/nginx/conf.d:ro
      - ./nginx/config/ssl:/etc/nginx/ssl:ro
    depends_on:
      - gl1
    networks:
      - graylog.net
  #
  # MongoDB: https://hub.docker.com/_/mongo/
  #
  mongo:
    image: mongo:3
    container_name: mongo
    hostname: mongo
    restart: always
    mem_limit: 256m
    environment:
      - TZ=Europe/Berlin
    ports:
      # if no need to access the mongoDB from outside
      # remove this exposed port
      - 192.168.1.50:27017:27017
    volumes:
      - graylog.data.mongo:/data/db
      # set to servers data folder to be able to reuse
      #- /srv/glesmulti/mongo:/data/db
    networks:
      - graylog.net

  #
  # https://www.nosqlclient.com/ 
  #
  mongoclient:
    image: mongoclient/mongoclient
    container_name: mongoclient
    hostname: mongoclient
    restart: always
    mem_limit: 128m
    environment:
      - TZ=Europe/Berlin
      - MONGO_URL=mongodb://mongo:27017/meteor 
      # do be able to run it in a subfolder
      # we need to set this.
      - ROOT_URL=http://127.0.0.1/nosqlclient
    volumes:
      - graylog.data.mongoclient:/data/db
    depends_on:
      mongo:
        condition: service_started
    networks:
      - graylog.net

  # 
  # Build a two Elasticsearch Server Cluster that is reachable on localhost (to work with the cluster)
  # but also connected to the GL 
  #
  es1:
    #image: docker.elastic.co/elasticsearch/elasticsearch:5.6.12
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.5.4
    container_name: es1
    hostname: es1
    restart: always
    ulimits:
      memlock:
        soft: -1
        hard: -1
    mem_limit: 3g
    environment:
      - node.name=es1
      - TZ=Europe/Berlin
      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
      - http.host=0.0.0.0
      - transport.host=es1
      - network.host=0.0.0.0
      - bootstrap.memory_lock=true
      #- xpack.security.enabled=false
      #- xpack.watcher.enabled=false
      #- xpack.monitoring.enabled=false
      #- xpack.security.audit.enabled=false
      #- xpack.ml.enabled=false
      #- xpack.graph.enabled=false
      - discovery.zen.ping.unicast.hosts=10.10.10.51
    volumes:
      - graylog.data.es1:/usr/share/elasticsearch/data
    networks:
      graylog.net:
        ipv4_address: 10.10.10.50
    ports:
      - 192.168.1.50:9200:9200

  es2:
    #image: docker.elastic.co/elasticsearch/elasticsearch:5.6.12
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.5.4
    container_name: es2
    hostname: es2
    restart: always
    ulimits:
      memlock:
        soft: -1
        hard: -1
    mem_limit: 3g
    environment:
      - node.name=es2
      - TZ=Europe/Berlin
      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
      - http.host=0.0.0.0
      - transport.host=es2
      - network.host=0.0.0.0
      - bootstrap.memory_lock=true
      #- xpack.security.enabled=false
      #- xpack.watcher.enabled=false
      #- xpack.monitoring.enabled=false
      #- xpack.security.audit.enabled=false
      #- xpack.ml.enabled=false
      #- xpack.graph.enabled=false
      - discovery.zen.ping.unicast.hosts=10.10.10.50
    volumes:
      - graylog.data.es2:/usr/share/elasticsearch/data
    networks:
      graylog.net:
        ipv4_address: 10.10.10.51

  # Cerebro to work with Elasticsearch
  cerebro:
    image: yannart/cerebro:latest
    container_name: cerebro
    restart: always
    hostname: cerebro
    volumes:
      # the given configuration will provide cerebro 
      # at $HOSTNAME:9001/cerebro
      - ./cerebro/cerebro_application.conf:/opt/cerebro/conf/application.conf
      #- graylog.data.cerebro:/opt/cerebro/conf
    networks:
      - graylog.net


  # Graylog: https://hub.docker.com/r/graylog/graylog/
  # this will be the Graylog Master
  gl1:
    image: graylog/graylog:2.5
    #image: jalogisch/docker-graylog-alpine:2.5.0
    hostname: gl1 
    container_name: gl1
    restart: always
    mem_limit: 1500m

    environment:
      - TZ=Europe/Berlin
      - "GRAYLOG_SERVER_JAVA_OPTS=-Xms1g -Xmx1g -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow"
      - GRAYLOG_PASSWORD_SECRET=18e6a58d7c9efe94b04600bb716955f306467c25b552883cb9695d6a38128d49
      - GRAYLOG_ROOT_PASSWORD_SHA2=18e6a58d7c9efe94b04600bb716955f306467c25b552883cb9695d6a38128d49
      - GRAYLOG_REST_LISTEN_URI=http://0.0.0.0:9000/graylog/api
      - GRAYLOG_WEB_LISTEN_URI=http://0.0.0.0:9000/graylog
      # - GRAYLOG_REST_TRANSPORT_URI=http://127.0.0.1:9000/graylog/api
      - GRAYLOG_WEB_ENDPOINT_URI=http://127.0.0.1:9000/graylog/api
      - GRAYLOG_ELASTICSEARCH_HOSTS=http://10.10.10.51:9200,http://10.10.10.50:9200
      - GRAYLOG_TRUSTED_PROXIES=10.10.10.0/24,192.168.1.10/32
      - GRAYLOG_MONGODB_URI=mongodb://mongo/graylog
      - GRAYLOG_ALLOW_LEADING_WILDCARD_SEARCHES=true
    ports:
      # Graylog web interface and REST API
      - 192.168.1.50:9000:9000
      # Syslog TCP
      - 192.168.1.50:514:1514
      # Syslog UDP
      - 192.168.1.50:514:1514/udp
      # GELF TCP
      - 192.168.1.50:12201:12201
      # GELF UDP
      - 192.168.1.50:12201:12201/udp
      # BEATS
      - 192.168.1.50:5044:5044
      # RAW TCP
      - 192.168.1.50:5555:5555

    links:
      - mongo
      - es1
      - es2
      - gl2
    depends_on:
      mongo:
        condition: service_started
      es1:
        condition: service_started
      es2:
        condition: service_started
    volumes:
      - ./graylog/config/node-id.gl1:/usr/share/graylog/config/node-id
      # Shared folder to hold Lookup tables and similar
      - ./graylog/shared:/data/shared/
      - graylog.data.gl1.journal:/usr/share/graylog/data/journal
      # make archive folder for the Enterprise plugins
      - ./graylog/archives:/data/archives
      # http://docs.graylog.org/en/2.5/pages/enterprise/setup.html#tarball
      - ./graylog/plugins/graylog-plugin-archive-2.5.1.jar:/usr/share/graylog/plugin/graylog-plugin-archive.jar
      - ./graylog/plugins/graylog-plugin-auditlog-2.5.1.jar:/usr/share/graylog/plugin/graylog-plugin-auditlog.jar
      - ./graylog/plugins/graylog-plugin-license-2.5.1.jar:/usr/share/graylog/plugin/graylog-plugin-license.jar
      - ./graylog/plugins/graylog-plugin-enterprise-integrations-2.5.0+0.jar:/usr/share/graylog/plugin/graylog-plugin-enterprise-integrations-2.5.0+0.jar
      # https://github.com/Graylog2/graylog-plugin-auth-sso
      - ./graylog/plugins/graylog-plugin-auth-sso-2.5.1.jar:/usr/share/graylog/plugin/graylog-plugin-sso.jar
      # https://github.com/nexylan/graylog-rabbitmq
      - ./graylog/plugins/graylog-rabbitmq-1.3.0.jar:/usr/share/graylog/plugin/graylog-plugin-rabbitmq.jar
      # https://github.com/cvtienhoven/graylog-plugin-aggregates
      - ./graylog/plugins/graylog-plugin-aggregates-2.4.0.jar:/usr/share/graylog/plugin/graylog-plugin-aggretates.jar
      # https://github.com/airbus-cyber
      - ./graylog/plugins/graylog-plugin-aggregation-count-1.0.0.jar:/usr/share/graylog/plugin/graylog-plugin-aggregation-count-1.0.0.jar
      - ./graylog/plugins/graylog-plugin-correlation-count-1.0.0.jar:/usr/share/graylog/plugin/graylog-plugin-correlation-count-1.0.0.jar    
    networks:
      graylog.net:
        ipv4_address: 10.10.10.100

  # Graylog: https://hub.docker.com/r/graylog/graylog/
  # this will be the Graylog Master
  gl2:
    #image: jalogisch/docker-graylog-alpine:2.5.0
    image: graylog/graylog:2.5
    hostname: gl2 
    container_name: gl2
    mem_limit: 1500m

    environment:
      - GRAYLOG_IS_MASTER=false
      - TZ=Europe/Berlin
      - "GRAYLOG_SERVER_JAVA_OPTS=-Xms1g -Xmx1g -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow"
      - GRAYLOG_PASSWORD_SECRET=18e6a58d7c9efe94b04600bb716955f306467c25b552883cb9695d6a38128d49
      - GRAYLOG_ROOT_PASSWORD_SHA2=18e6a58d7c9efe94b04600bb716955f306467c25b552883cb9695d6a38128d49
      - GRAYLOG_REST_LISTEN_URI=http://0.0.0.0:9000/graylog/api
      - GRAYLOG_WEB_LISTEN_URI=http://0.0.0.0:9000/graylog
      # - GRAYLOG_REST_TRANSPORT_URI=http://127.0.0.1:9000/graylog/api
      # - GRAYLOG_WEB_ENDPOINT_URI=http://127.0.0.1:9000/graylog/api
      - GRAYLOG_MONGODB_URI=mongodb://mongo/graylog
      - GRAYLOG_ELASTICSEARCH_HOSTS=http://10.10.10.51:9200,http://10.10.10.50:9200
      - GRAYLOG_ALLOW_LEADING_WILDCARD_SEARCHES=true
      - GRAYLOG_TRUSTED_PROXIES=10.10.10.0/24,192.168.1.10/32
    ports:
      # Graylog web interface and REST API
      - 192.168.1.51:9000:9000
      # Syslog TCP
      - 192.168.1.51:514:1514
      # Syslog UDP
      - 192.168.1.51:514:1514/udp
      # GELF TCP
      - 192.168.1.51:12201:12201
      # GELF UDP
      - 192.168.1.51:12201:12201/udp
      # BEATS
      - 192.168.1.51:5044:5044
      # RAW TCP
      - 192.168.1.51:5555:5555

    links:
      - mongo
      - es1
      - es2
      
    depends_on:
      mongo:
        condition: service_started
      es1:
        condition: service_started
      es2:
        condition: service_started
    volumes:
      - ./graylog/config/node-id.gl2:/usr/share/graylog/config/node-id
      # Shared folder to hold Lookup tables and simila
      - ./graylog/shared:/data/shared/
      - graylog.data.gl2.journal:/usr/share/graylog/data/journal
      # make archive folder for the Enterprise plugins
      - ./graylog/archives:/data/archives
      # http://docs.graylog.org/en/2.5/pages/enterprise/setup.html#tarball
      - ./graylog/plugins/graylog-plugin-archive-2.5.1.jar:/usr/share/graylog/plugin/graylog-plugin-archive.jar
      - ./graylog/plugins/graylog-plugin-auditlog-2.5.1.jar:/usr/share/graylog/plugin/graylog-plugin-auditlog.jar
      - ./graylog/plugins/graylog-plugin-license-2.5.1.jar:/usr/share/graylog/plugin/graylog-plugin-license.jar
      - ./graylog/plugins/graylog-plugin-enterprise-integrations-2.5.0+0.jar:/usr/share/graylog/plugin/graylog-plugin-enterprise-integrations-2.5.0+0.jar
      # https://github.com/Graylog2/graylog-plugin-auth-sso
      - ./graylog/plugins/graylog-plugin-auth-sso-2.5.1.jar:/usr/share/graylog/plugin/graylog-plugin-sso.jar
      # https://github.com/nexylan/graylog-rabbitmq
      - ./graylog/plugins/graylog-rabbitmq-1.3.0.jar:/usr/share/graylog/plugin/graylog-plugin-rabbitmq.jar
      # https://github.com/cvtienhoven/graylog-plugin-aggregates
      - ./graylog/plugins/graylog-plugin-aggregates-2.4.0.jar:/usr/share/graylog/plugin/graylog-plugin-aggretates.jar
      # https://github.com/airbus-cyber
      - ./graylog/plugins/graylog-plugin-aggregation-count-1.0.0.jar:/usr/share/graylog/plugin/graylog-plugin-aggregation-count-1.0.0.jar
      - ./graylog/plugins/graylog-plugin-correlation-count-1.0.0.jar:/usr/share/graylog/plugin/graylog-plugin-correlation-count-1.0.0.jar
    networks:
      graylog.net:
        ipv4_address: 10.10.10.101