version: "2.3"
services:
  mongo:
    image: mongo:3
    restart: always
    volumes:
      - graylog_mongo_data_db:/data/db
      - graylog_mongo_data_configdb:/data/configdb
  elasticsearch:
    image: elasticsearch:5.6
    environment:
      - http.host=0.0.0.0
      - xpack.security.enabled=false
      - indices.store.throttle.max_bytes_per_sec=150mb
      - "ES_JAVA_OPTS=-Xms2048m -Xmx2048m"
    restart: always
    mem_limit: 10g
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - graylog_elasticsearch_data:/usr/share/elasticsearch/data
  graylog:
    restart: always
    image: graylog/graylog
    environment:
      - GRAYLOG_PASSWORD_SECRET=INqAK0uC0DgcfGGDln7Qwct8jvK8ED1Yk2Yw2wuFcZbVRLx2yWXjkzLAgQJbgGs5Ddw4chhEQk0VDOaQdTTzTSkzIqMOE8y9
      - GRAYLOG_ROOT_PASSWORD_SHA2=99d25f3eb03e12af51212825ba05f17989ab23cf4526960b5e3c8dc9e76b5198
      - GRAYLOG_WEB_ENDPOINT_URI=http://my.host.replaced/api
      - GRAYLOG_MONGODB_URI=mongodb://mongo/graylog
      - GRAYLOG_ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    links:
      - mongo
      - elasticsearch
    ports:
      # Web interface
      - 80:9000
      # Beats (Filebeats)
      - 5044:5044
      - 5044:5044/udp
      - 5045:5045
      - 5045:5045/udp
      - 12201:12201
    volumes:
      - graylog_data:/usr/share/graylog/data

volumes:
  graylog_mongo_data_db:
  graylog_mongo_data_configdb:
  graylog_elasticsearch_data:
  graylog_data: