可能需手动在 /etc/sysctl.conf 添加 vm.max_map_count=262144，或执行命令

sysctl -w vm.max_map_count=262144

mongodb文件夹

https://pan.quark.cn/s/4bbcda907bf0

.env

GRAYLOG_PASSWORD_SECRET="使用命令 pwgen -N 1 -s 96 命令生成的随机值"
GRAYLOG_ROOT_PASSWORD_SHA2="使用命令 echo -n 密码 | shasum -a 256 得到加密值"

docker-compose.yml

version: "3.8"

services:
  mongodb1:
    image: "mongo:5.0"
    hostname: "mongodb1"
    command: ["mongod", "--bind_ip_all", "--replSet", "rs0"]
    volumes:
      - "mongodb-data-01:/data/db"
      - "./mongodb/initdb.d:/docker-entrypoint-initdb.d"
      - "./mongodb/init-replset.js:/init-replset.js"
    restart: "on-failure"

  mongodb2:
    image: "mongo:5.0"
    hostname: "mongodb2"
    command: ["mongod", "--bind_ip_all", "--replSet", "rs0"]
    volumes:
      - "mongodb-data-02:/data/db"
    restart: "on-failure"

  mongodb3:
    image: "mongo:5.0"
    hostname: "mongodb3"
    command: ["mongod", "--bind_ip_all", "--replSet", "rs0"]
    volumes:
      - "mongodb-data-03:/data/db"
    restart: "on-failure"

  opensearch1:
    image: "opensearchproject/opensearch:2.4.0"
    hostname: "opensearch1"
    environment:
      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - "OPENSEARCH_HEAP_SIZE=1g"
      - "node.name=opensearch1"
      - "cluster.name=os-docker-cluster"
      - "discovery.seed_hosts=opensearch2,opensearch3"
      - "cluster.initial_master_nodes=opensearch1,opensearch2,opensearch3"
      - "bootstrap.memory_lock=true"
      - "action.auto_create_index=false"
      - "plugins.security.ssl.http.enabled=false"
      - "plugins.security.disabled=true"
    ulimits:
      memlock:
        hard: -1
        soft: -1
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "9200:9200"
    volumes:
      - "opensearch-data-01:/usr/share/opensearch/data"
    restart: "on-failure"

  opensearch2:
    image: "opensearchproject/opensearch:2.4.0"
    hostname: "opensearch2"
    environment:
      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - "OPENSEARCH_HEAP_SIZE=1g"
      - "node.name=opensearch2"
      - "cluster.name=os-docker-cluster"
      - "discovery.seed_hosts=opensearch1,opensearch3"
      - "cluster.initial_master_nodes=opensearch1,opensearch2,opensearch3"
      - "bootstrap.memory_lock=true"
      - "action.auto_create_index=false"
      - "plugins.security.ssl.http.enabled=false"
      - "plugins.security.disabled=true"
    ulimits:
      memlock:
        hard: -1
        soft: -1
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "9201:9200"
    volumes:
      - "opensearch-data-02:/usr/share/opensearch/data"
    restart: "on-failure"

  opensearch3:
    image: "opensearchproject/opensearch:2.4.0"
    hostname: "opensearch3"
    environment:
      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - "OPENSEARCH_HEAP_SIZE=1g"
      - "node.name=opensearch3"
      - "cluster.name=os-docker-cluster"
      - "discovery.seed_hosts=opensearch1,opensearch2"
      - "cluster.initial_master_nodes=opensearch1,opensearch2,opensearch3"
      - "bootstrap.memory_lock=true"
      - "action.auto_create_index=false"
      - "plugins.security.ssl.http.enabled=false"
      - "plugins.security.disabled=true"
    ulimits:
      memlock:
        hard: -1
        soft: -1
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "9202:9200"
    volumes:
      - "opensearch-data-03:/usr/share/opensearch/data"
    restart: "on-failure"

  graylog1:
    image: "${GRAYLOG_IMAGE:-graylog/graylog:5.1}"
    hostname: "graylog1"
    depends_on:
      - "mongodb1"
      - "mongodb2"
      - "mongodb3"
      - "opensearch1"
      - "opensearch2"
      - "opensearch3"
    entrypoint: "/docker-entrypoint.sh"
    environment:
      GRAYLOG_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:?Please configure GRAYLOG_PASSWORD_SECRET in the .env file}"
      GRAYLOG_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:?Please configure GRAYLOG_ROOT_PASSWORD_SHA2 in the .env file}"
      GRAYLOG_HTTP_EXTERNAL_URI: "http://127.0.0.1:9000/"
      GRAYLOG_ELASTICSEARCH_HOSTS: "http://opensearch1:9200,http://opensearch2:9201,http://opensearch3:9202"
      GRAYLOG_MONGODB_URI: "mongodb://mongodb1:27017,mongodb2:27017,mongodb3:27017/graylog"
    ports:
      - "9000:9000"        # Graylog web interface and REST API
      - "1514:1514"        # Syslog TCP
      - "1514:1514/udp"    # Syslog UDP
      - "12201:12201"      # GELF TCP
      - "12201:12201/udp"  # GELF UDP
      - "5044:5044"
    volumes:
      - "graylog-data-01:/usr/share/graylog/data/data"
      - "graylog-journal-01:/usr/share/graylog/data/journal"
    restart: "on-failure"

  graylog2:
    image: "${GRAYLOG_IMAGE:-graylog/graylog:5.1}"
    hostname: "graylog2"
    depends_on:
      - "mongodb1"
      - "mongodb2"
      - "mongodb3"
      - "opensearch1"
      - "opensearch2"
      - "opensearch3"
    entrypoint: "/docker-entrypoint.sh"
    environment:
      GRAYLOG_IS_MASTER: "false"
      GRAYLOG_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:?Please configure GRAYLOG_PASSWORD_SECRET in the .env file}"
      GRAYLOG_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:?Please configure GRAYLOG_ROOT_PASSWORD_SHA2 in the .env file}"
      GRAYLOG_HTTP_EXTERNAL_URI: "http://127.0.0.1:9000/"
      GRAYLOG_HTTP_BIND_ADDRESS: "0.0.0.0:9001"
      GRAYLOG_ELASTICSEARCH_HOSTS: "http://opensearch1:9200,http://opensearch2:9201,http://opensearch3:9202"
      GRAYLOG_MONGODB_URI: "mongodb://mongodb1:27017,mongodb2:27017,mongodb3:27017/graylog"
    ports:
      - "9001:9001"         # Graylog web interface and REST API
      - "1515:1514"         # Syslog TCP
      - "1515:1514/udp"     # Syslog UDP
      - "12202:12201"       # GELF TCP
      - "12202:12201/udp"   # GELF UDP
      - "5045:5044"
    volumes:
      - "graylog-data-02:/usr/share/graylog/data/data"
      - "graylog-journal-02:/usr/share/graylog/data/journal"
    restart: "on-failure"

  graylog3:
    image: "${GRAYLOG_IMAGE:-graylog/graylog:5.1}"
    hostname: "graylog3"
    depends_on:
      - "mongodb1"
      - "mongodb2"
      - "mongodb3"
      - "opensearch1"
      - "opensearch2"
      - "opensearch3"
    entrypoint: "/docker-entrypoint.sh"
    environment:
      GRAYLOG_IS_MASTER: "false"
      GRAYLOG_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:?Please configure GRAYLOG_PASSWORD_SECRET in the .env file}"
      GRAYLOG_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:?Please configure GRAYLOG_ROOT_PASSWORD_SHA2 in the .env file}"
      GRAYLOG_HTTP_EXTERNAL_URI: "http://127.0.0.1:9000/"
      GRAYLOG_HTTP_BIND_ADDRESS: "0.0.0.0:9002"
      GRAYLOG_ELASTICSEARCH_HOSTS: "http://opensearch1:9200,http://opensearch2:9201,http://opensearch3:9202"
      GRAYLOG_MONGODB_URI: "mongodb://mongodb1:27017,mongodb2:27017,mongodb3:27017/graylog"
    ports:
      - "9002:9002"       # Graylog web interface and REST API
      - "1516:1514"       # Syslog TCP
      - "1516:1514/udp"   # Syslog UDP
      - "12203:12201"     # GELF TCP
      - "12203:12201/udp" # GELF UDP
      - "5046:5044"
    volumes:
      - "graylog-data-03:/usr/share/graylog/data/data"
      - "graylog-journal-03:/usr/share/graylog/data/journal"
    restart: "on-failure"


volumes:
  opensearch-data-01:
  opensearch-data-02:
  opensearch-data-03:
  graylog-data-01:
  graylog-data-02:
  graylog-data-03:
  graylog-journal-01:
  graylog-journal-02:
  graylog-journal-03:
  mongodb-data-01:
  mongodb-data-02:
  mongodb-data-03:

优化

编辑进入 Docker 容器，编辑 /etc/graylog/server/server.conf 禁止检查更新。

versionchecks = false