Configuration Settings

Graylog includes several important configuration files that control configuration settings for the service. Some configuration must be completed during installation while additional configuration steps can be completed only after installation is complete.

This article reviews the important configuration files in Graylog as well as several additional configuration steps you might need to consider.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

  • You must be a Graylog administrator to adjust Graylog and Data Node configuration settings.

Highlights

The following highlights provide a summary of the key takeaways from this article:

  • The server.conf file controls core aspects like performance, security, and cluster connections.

  • The datanode.conf file manages Data Node settings, including security and performance optimizations.

  • Some properties are duplicated across configuration files. In multi-node setups, ensure settings that must match are consistent and unique settings are correctly applied per node.

  • Be sure to adjust configurations for MongoDB, JVM heap settings, and, if needed, custom OpenSearch deployments.

Server.conf

The server.conf file contains configuration properties to control many aspects of your Graylog deployment. You can adjust server properties to affect performance, improve security, create connections to other nodes in a cluster, and many other options.

Most of the properties in this file are rarely needed. Occasionally, Graylog support might ask you to adjust a property setting for troubleshooting or performance issues, but otherwise you can generally leave most settings at their default values.

Hint: You must set or update several server.conf properties during initial installation so that the Graylog service starts and so that you can access the web interface. See Initial Configuration Settings for details.

The default location for the server.conf file is /etc/graylog/server/server.conf. For a complete list of properties in server.conf, see Server Configuration Settings Reference.

Datanode.conf

The datanode.conf file contains configuration properties specific to Data Node and the underlying OpenSearch search backend. Like server.conf, the properties in this file can adjust performance and security and are used to create connections to other nodes in a cluster or to MongoDB, along with many other options.

The datanode.conf default values work well in most environments, but you might find properties to adjust for best results in your installation.

The default location for the datanode.conf file is /etc/graylog/datanode/datanode.conf. For a complete list of properties in datanode.conf, see Data Node Configuration Settings Reference.

Duplicate Properties and Multi-Node Environments

You will find some properties that are the same in both server.conf and datanode.conf. Also, each node in a multi-node environment includes its own configuration file for both server.conf and datanode.conf. Many of these properties provide connection information so that different nodes can connect to each other.

You must ensure these properties are set correctly in each file on every node. In some cases, the setting must be the same across nodes, while in others the setting must be different. Check Initial Configuration Settings or the configuration property reference topics for complete information about each property:

Additional Configuration

In addition to Graylog's primary configuration files, you might need to complete some configuration for additional components:

  • MongoDB: This database is responsible for storing metadata and configuration data for Graylog. You often need to adjust MongoDB properties to allow multiple Graylog nodes access to the shared database.

  • Java Virtual Machine (JVM) heap settings: Graylog, Data Node, and OpenSearch are Java applications, and you need to control the amount of memory allocated to each for optimal system performance.

  • OpenSearch: In some cases, OpenSearch is the search backend for your installation. OpenSearch is typically managed by Graylog with Data Node. However, for custom installations, specific use cases, or legacy environments, you might need to adjust OpenSearch configuration.

Warning: It is possible to deploy Graylog with self-managed OpenSearch; however, Data Node is the recommended search backend for use with Graylog.

For more information about each of these configuration areas, see Additional Configuration.