--- title: "Install Graylog" slug: "install-graylog" updated: 2025-04-30T10:05:13Z published: 2025-04-30T10:05:13Z canonical: "help.symphonysummitai.com/install-graylog" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.symphonysummitai.com/llms.txt > Use this file to discover all available pages before exploring further. # Install Graylog Graylog is an open-source log management and analysis tool designed for collecting, indexing, and analyzing log data in real-time. It centralizes logs from various sources, including servers, applications, and network devices, offering a unified platform for monitoring and troubleshooting. With its scalable architecture, Graylog enables users to store large volumes of log data, perform searches, create alerts based on specific conditions, and visualize data through dashboards. It supports plugins for extending functionality and integrates with other tools in the DevOps and IT operations ecosystem. Graylog is valued for its ease of use, powerful querying capabilities, and robust features that aid in maintaining system reliability and security through comprehensive log analysis. ## Install Graylog To install Graylog (Version 6.0.0) on Ubuntu, perform the following steps: 1. Update your local package index to ensure you have the latest version of available packages. **sudo apt update** 2. Install the following set of dependencies needed during the installation of the Graylog server. **sudo apt install curl wget apt-transport-https** ### Install Open JDK Before installing Graylog, **Java** needs to be installed. Install OpenJDK, a free and open-source implementation of Java currently maintained by Oracle. The latest version of Graylog - Graylog 5.2 - requires at least OpenJDK 17. 1. To install OpenJDK 17, run the command. **sudo apt install openjdk-17-jre-headless -y** 2. After installing Java, to confirm the version of Java, run the command. **java -version** ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1721398732346.png)Figure: Java version ### Install ElasticSearch Elasticsearch is another critical component in the Graylog installation. It’s a distributed search and analytics engine widely used for full-text search, log analysis, business analytics, and analyzing security events. In Graylog, Elasticsearch stores, searches, and analyzes logs and messages from external sources. 1. Elasticsearch is not hosted on official Ubuntu repositories. Hence, the Elasticsearch repository needs to be installed. First, download and add the Elasticsearch GPG Key. **curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -** 2. Switch to the Root User. **sudo su -** 3. Add the Elasticsearch repository to the system. **echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list** 4. Update the local cache to notify the system of the newly added repository. **apt update** 5. Use the APT package manager to install Elasticsearch from the repository after the local cache has been updated. **apt install elasticsearch -y** ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1721398687980.png)Figure: Install APT package 6. After the installation is finished, the primary Elasticsearch configuration file needs to be adjusted a little. Open the file in your preferred text editor. The command-line editor nano is being used here. **nano /etc/elasticsearch/elasticsearch.yml** 7. Set your preferred cluster name and add the **action.auto_create_inde****x: false** line below it. **cluster.name: graylog action.auto_create_index: false** 8. Save the changes and exit. Reload systemd for the change to apply and start Elasticsearch. **systemctl daemon-reload systemctl start elasticsearch** 9. Verify the status of Elasticsearch as shown. **sudo systemctl status elasticsearch** ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1721399718023.png)Figure: Status of elasticsearch 10. Enable the Elasticsearch service to start on boot. **systemctl enable elasticsearch** 11. Send a **GET** request to your node using the **curl** command-line tool to view detailed information about Elasticsearch. **curl -X GET [http://localhost:9200](http://localhost:9200)** ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1721400010612.png)Figure: Detailed information of Elasticsearch ### Install MongoDB server User and configuration data are stored in the MongoDB database of the Graylog server. Graylog version latest requires MongoDB 5.x and 6.x releases. Install MongoDB 6.0 using the MongoDB repository from this instruction. 1. Add the MongoDB GPG signing key. **curl -fsSL https://pgp.mongodb.com/server-6.0.asc | \ sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/mongodb-server-6.0.gpg** 2. Next, add the MongoDB repository to the sources.list.d directory on your system. **echo "deb [ arch=amd64,arm64 signed=/etc/apt/trusted.gpg.d/keyrings/mongodb-server-6.0.gpg ] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/6.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list** 3. With the repository added to your system, update the local APT cache. **sudo apt update** 4. Then install the MongoDB database server. **sudo apt install mongodb-org -y** ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1721400347578.png)Figure: Install MongoDB server 5. To verify the version installed, run the command: **mongod --version** ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1721400529393.png)Figure: MongoDB version 6. MongoDB does not start automatically upon installation, so start it as shown. **sudo systemctl start mongod** 7. Confirm that the MongoDB database service is running: **sudo systemctl status mongod** ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1721400658204.png)Figure: MongoDB service 8. Enable the service to auto-start on boot. **sudo systemctl enable mongod** With the MongoDB database server installed, the next step is to install the Graylog server. ### Install Graylog Server The installation of Graylog server on Ubuntu is now complete. The Graylog server package is not by default accessible through Ubuntu repositories. As a result, we will install Graylog using the official repository. 1. Download the Graylog Debian package. **wget [https://packages.graylog2.org/repo/packages/graylog-5.2-repository_latest.deb](https://packages.graylog2.org/repo/packages/graylog-5.2-repository_latest.deb)** 2. Next, run the dpkg command to run the package. **sudo dpkg -i graylog-5.0-repository_latest.deb** 3. Next, update the local APT cache. **sudo apt-get update** 4. Finally, install the Graylog server as follows. **sudo apt install graylog-server -y** ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1721400999346.png)Figure: Graylog server 5. After installing the Graylog server, you must create an encrypted password for the admin user and a secret to protect the user passwords. 6. To generate a secret password for securing user passwords, run the following command: **< /dev/urandom tr -dc A-Z-a-z-0-9 | head -c${1:-96};echo;** 7. The encrypted password, composed of alphanumeric characters, will be displayed on the terminal. 8. Generate an encrypted password for the Graylog admin login user. **echo -n "Enter Password: " && head -1