Overview
This AMI provides a production-ready Graylog Enterprise 6.1 installation, pre-configured with Docker containers for simplified deployment and management. Built on Ubuntu 22.04 LTS, it includes MongoDB 6.0.18, Graylog Datanode 6.1, and Graylog Enterprise Server 6.1, all orchestrated via Docker Compose for reliability and ease of maintenance.
For optimal performance, deploy this AMI on a t3.large or better instance with minimum 50GB storage. The AMI automatically configures itself on first boot, generating secure credentials and optimizing system settings for production use. Required ports include TCP 9000 (Web Interface), TCP 5044 (Beats), TCP/UDP 5140 (Syslog), TCP/UDP 12201 (GELF), and TCP 13301/13302 (Forwarder).
After launching an instance, the initial setup takes approximately 2-3 minutes. The initial credentials (username and password) can be found in '/opt/graylog/credentials.txt' and are also output to the system log. Please use the generated credentials for the initial setup wizard, accessible on port 9000. After completing the setup wizard, the GrayLog web interface will be accesible with default username: 'admin' and password: 'admin'. The AMI implements enterprise-grade security practices, including secure credential storage and proper log rotation, making it ready for immediate production use.
Highlights
- Get Graylog up and running in minutes instead of hours
Details
Typical total price
$0.093/hour
Features and programs
Financing for AWS Marketplace purchases
Pricing
- ...
Instance type | Product cost/hour | EC2 cost/hour | Total/hour |
|---|---|---|---|
t2.medium | $0.01 | $0.046 | $0.056 |
t2.large | $0.01 | $0.093 | $0.103 |
t2.xlarge | $0.01 | $0.186 | $0.196 |
t2.2xlarge | $0.01 | $0.371 | $0.381 |
t3.medium | $0.01 | $0.042 | $0.052 |
t3.large Recommended | $0.01 | $0.083 | $0.093 |
t3.xlarge | $0.01 | $0.166 | $0.176 |
t3.2xlarge | $0.01 | $0.333 | $0.343 |
t3a.medium | $0.01 | $0.038 | $0.048 |
t3a.large | $0.01 | $0.075 | $0.085 |
Additional AWS infrastructure costs
Type | Cost |
|---|---|
EBS General Purpose SSD (gp2) volumes | $0.10/per GB/month of provisioned storage |
Vendor refund policy
Refund requests will be considered within 48 hours of purchase if the AMI fails to deploy or the Graylog server fails to start due to technical issues with our configuration. Refunds are not available after successful deployment or if issues arise from customer misconfiguration, network issues, or modification of the base configuration. Contact support@graylogger.com with your AWS Account ID and Instance ID to request a refund. All refund decisions are final.
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Version 6.1.7-1 Release Notes
Initial Release Features:
- Graylog Open 6.1.7 pre-installed and configured
- MongoDB 6.0.18 as the backing database
- Complete Docker-based deployment for easy maintenance
- Auto-generates secure random password on first launch
- All components pre-configured for immediate use
- Automatic service startup via systemd
- All ports properly configured and exposed
Key Components:
- Graylog Open Server 6.1.7
- Graylog Datanode 6.1
- MongoDB 6.0.18
- Docker and Docker Compose latest stable versions
Security Features:
- Random password generation on first boot
- One-time use credentials securely logged to system log
- All service passwords and secrets automatically configured
- Docker containers running with appropriate security contexts
Network Configuration:
- Web Interface: Port 9000
- Syslog TCP/UDP: Port 5140
- GELF TCP/UDP: Port 12201
- Beats: Port 5044
- Forwarder Data: Port 13301
- Forwarder Config: Port 13302
- MongoDB: Port 27017 (internal)
- Datanode API: Port 8999
First Boot Instructions:
- Launch the instance
- Wait for initial setup (approximately 2-3 minutes)
- Retrieve auto-generated admin password from:
- System log (formatted box display)
- /opt/graylog/credentials.txt
- Access initial config interface at http://[your-instance-ip]:9000
- Log in with username 'admin' and the generated password
- Once the initial config interface concludes, use the Graylog default username 'admin' and password 'admin' to access the Graylog UI
Note: The instance will automatically configure itself on first boot. No manual configuration is required.
Known Limitations:
- Initial password must be retrieved from system log or credentials.txt file
- HTTP access only (HTTPS can be configured post-deployment)
This AMI is designed for rapid deployment of Graylog Open in production environments. All components are configured following best practices for security and performance.
Additional details
Usage instructions
USAGE INSTRUCTIONS
Instance Access & Initial Setup
- Launch your instance from AWS Marketplace
- Configure security groups to allow the following ports:
- TCP 9000 (Web Interface)
- TCP/UDP 5140 (Syslog)
- TCP/UDP 12201 (GELF)
- TCP 5044 (Beats)
- TCP 13301, 13302 (Forwarder)
Accessing Your Graylog Server
- Wait 2-3 minutes after instance launch for setup to complete
- Find your admin credentials in two ways:
- Check system logs: sudo grep -A 6 "Initial" /var/log/syslog
- Or read the password file: sudo cat /opt/graylog/credentials.txt
- Access the initial config wizard at http://[your-instance-ip]:9000
- Log in with:
- Username: admin
- Password: (from step 2)
- Once initial config concludes, access the Graylog Web Interface (same port) with default login credentials:
- Username: admin
- Password: admin
Container Management
- Check container status: docker ps
- View container logs: docker-compose -f /opt/graylog/docker-compose.yml logs
- Restart services: sudo systemctl restart graylog-docker
Default File Locations
- Docker Compose file: /opt/graylog/docker-compose.yml
- Password file: /opt/graylog/credentials.txt
Support
- Email: contact@graylogger.com
- Phone: +1 (629) 239-0199
- For official Graylog documentation: https://docs.graylog.org/
Note: For production use, we recommend configuring HTTPS and changing the default password after initial login.
Support
Vendor support
Email Support: support@graylogger.com Phone Support: +1 (629) 239-0199
Support includes help with password retrieval, container startup issues, and general connectivity troubleshooting. Response time is typically within 24 hours for email support. For Graylog-specific features and functionality, customers should refer to official Graylog documentation and support channels.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
