Install Graylog 3 with Elasticsearch 6.x and mongodb 4.x on CentOS 7 / RHEL 7 Linux

In this guide, we will take you through the steps to Install Graylog on CentOS 7 / RHEL 7 with Elasticsearch 6.x and MongoDB 4.x. Graylog is an open-source log management system that allows operations team to aggregate tons of log data, from multiple log sources.

Graylog comes with out of the box GUI, powerful search feature, alerting and reporting. Graylog UI is simple and intuitive with complete user management and security.

Install Graylog 3.x on CentOS 7 / RHEL 7 Linux

Graylog requires Java, Elasticsearch, and MongoDB. Elasticsearch is responsible for logs storage and search. Enough talk, Lets begin with the installation of the dependencies and then install Graylog.

Install Java on RHEL 7 / CentOS 7

As Elasticsearch depends on Java 8, you need it installed it before Elasticsearch RHEL 7 / CentOS 7.

yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel
[root@dockerworkernode2 ~]# yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel
Loaded plugins: fastestmirror
base                                                                                                     | 3.6 kB  00:00:00
docker-ce-edge                                                                                           | 3.5 kB  00:00:00
docker-ce-stable                                                                                         | 3.5 kB  00:00:00
extras                                                                                                   | 2.9 kB  00:00:00
updates                                                                                                  | 2.9 kB  00:00:00
(1/8): docker-ce-stable/x86_64/updateinfo                                                                |   55 B  00:00:01
(2/8): docker-ce-stable/x86_64/primary_db                                                                |  37 kB  00:00:00

.
.
.
Installed:
  java-1.8.0-openjdk.x86_64 1:1.8.0.232.b09-0.el7_7           java-1.8.0-openjdk-devel.x86_64 1:1.8.0.232.b09-0.el7_7

Dependency Installed:
  atk.x86_64 0:2.28.1-1.el7                                            avahi-libs.x86_64 0:0.6.31-19.el7
  cairo.x86_64 0:1.15.12-4.el7                                         copy-jdk-configs.noarch 0:3.3-10.el7_5
  cups-libs.x86_64 1:1.6.3-40.el7                                      dejavu-fonts-common.noarch 0:2.33-6.el7
  dejavu-sans-fonts.noarch 0:2.33-6.el7                                fontconfig.x86_64 0:2.13.0-4.3.el7

Install Elasticsearch 6 on RHEL 7 / CentOS 7

Add Elasticsearch repository:

[root@dockerworkernode2 ~]# cat <<EOF |  tee /etc/yum.repos.d/elasticsearch.repo
 [elasticsearch-6.x]
 name=Elasticsearch repository for 6.x packages
 baseurl=https://artifacts.elastic.co/packages/oss-6.x/yum
 gpgcheck=1
 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
 enabled=1
 autorefresh=1
 type=rpm-md
 EOF

[root@dockerworkernode2 ~]#

Install Elasticsearch:

[root@dockerworkernode2 ~]# yum -y install elasticsearch-oss
Loaded plugins: fastestmirror
elasticsearch-6.x                                                                                        | 1.3 kB  00:00:00
elasticsearch-6.x/primary                                                                                | 125 kB  00:00:02
Loading mirror speeds from cached hostfile
 * base: mirrors.piconets.webwerks.in
 * extras: mirrors.piconets.webwerks.in
 * updates: mirrors.piconets.webwerks.in
elasticsearch-6.x                                                                                                       393/393
Resolving Dependencies

Configure Elasticsearch for Graylog:

You need to modify the Elasticsearch configuration file and set the cluster name to graylog and add action.auto_create_index: false to the configuration file:

The file to edit is /etc/elasticsearch/elasticsearch.yml.

$  vi /etc/elasticsearch/elasticsearch.yml
cluster.name: graylog
action.auto_create_index: false

Start and enable elasticsearch service:

 systemctl daemon-reload
 systemctl enable --now elasticsearch

Confirm service status:

[root@dockerworkernode2 ~]# systemctl daemon-reload
[root@dockerworkernode2 ~]# systemctl enable --now elasticsearch
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.
[root@dockerworkernode2 ~]# systemctl status elasticsearch
● elasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2019-12-11 19:25:03 IST; 15s ago
     Docs: http://www.elastic.co
 Main PID: 2053 (java)
   Memory: 840.0M
   CGroup: /system.slice/elasticsearch.service
           └─2053 /bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiating...

Dec 11 19:25:03 dockerworkernode2.org systemd[1]: Started Elasticsearch.
Dec 11 19:25:03 dockerworkernode2.org systemd[1]: Starting Elasticsearch...
Dec 11 19:25:04 dockerworkernode2.org elasticsearch[2053]: OpenJDK 64-Bit Server VM warning: If the number of processors ...ds=N
Hint: Some lines were ellipsized, use -l to show in full.
[root@dockerworkernode2 ~]#

How to Install MongoDB 4 on RHEL 7 / CentOS 7

MongoDB is used for storing Graylog related configurations. Install it on CentOS 7 / RHEL 7 using the steps shared in the article below.

Install MongoDB on RHEL 7 / CentOS 7

Install Graylog 3 on RHEL 7 / CentOS 7

Now install the Graylog repository configuration:

 rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-3.1-repository_latest.rpm
Graylog rpm packages are available on added repository.

[root@dockerworkernode2 ~]# rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-3.1-repository_latest.rpm
Retrieving https://packages.graylog2.org/repo/packages/graylog-3.1-repository_latest.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:graylog-3.1-repository-1-1       ################################# [100%]
 

 yum install graylog-server

[root@dockerworkernode2 ~]# yum install graylog-server -y
Loaded plugins: fastestmirror
graylog                                                                                                  | 2.9 kB  00:00:00
graylog/x86_64/primary_db                                                                                | 9.5 kB  00:00:02
Loading mirror speeds from cached hostfile
################################################################################
Graylog does NOT start automatically!

Please run the following commands if you want to start Graylog automatically on system boot:

     systemctl enable graylog-server.service

     systemctl start graylog-server.service

################################################################################
  Verifying  : graylog-server-3.1.3-1.noarch                                                                                1/1

Installed:
  graylog-server.noarch 0:3.1.3-1

Complete!
[root@dockerworkernode2 ~]#

You need to set  password_secret and root_password_sha2 variables under /etc/graylog/server/server.conf. These settings are mandatory and without them, Graylog will not start!

Use the following command to create your root_password_sha2:

echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1

Set generated value in root_password_sha2

$  vi /etc/graylog/server/server.conf

root_username = admin
root_password_sha2 = Sha2Passowrd
Generate password_secret.

$  yum -y install pwgen
$ pwgen -N 1 -s 96
<password_secret>

$  vi /etc/graylog/server/server.conf
password_secret = <password_secret>

To be able to connect to Graylog you should set http_bind_address  IP address of the machine you can connect to.

http_bind_address = 0.0.0.0:9000

Now enable and start Graylog service:

1.  systemctl daemon-reload
2.  systemctl enable graylog-server.service
3.  systemctl start graylog-server.service

[root@dockerworkernode2 ~]# systemctl status graylog-server.service
● graylog-server.service - Graylog server
   Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2019-12-12 21:26:28 IST; 5s ago
     Docs: http://docs.graylog.org/

How to Install Graylog 3 with Elasticsearch 6.x and mongodb 4.x on CentOS 8 / RHEL 8 Linux