Configure Graylog to Use MongoDB Password Authentication

Graylog stores its metadata and configuration data in MongoDB. By default, Graylog connects to MongoDB without authentication, but you can secure this connection with a dedicated MongoDB user and password. This article explains how to create the required MongoDB user with the correct roles and how to point Graylog at an authenticated connection. The steps apply whether you are setting up a new cluster or adding authentication to an existing one.

To grant a user permission to view MongoDB node metrics on the Cluster Configuration page, see Roles and Permissions for MongoDB Access.

Important: The MongoDB user that Graylog connects with must include the readWrite role in addition to any monitoring roles. A user missing readWrite cannot read or write Graylog data, which prevents Graylog from starting.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

MongoDB is installed and reachable from every Graylog and Data Node host.
You have administrator credentials for MongoDB (a user with permission to create users and grant roles, such as one holding the userAdmin or root role on the admin database).
You have access to edit server.conf and datanode.conf on every node, and permission to restart the Graylog and Data Node services.

Planning Considerations

This article assumes that MongoDB access control (authorization enforcement) is already enabled on your MongoDB deployment, or that you are prepared to enable it immediately after completing this configuration. Enabling access control on the MongoDB server itself, for example by setting security.authorization: enabled in mongod.conf, is a MongoDB administration task that this article does not cover. For those steps, see the MongoDB documentation.

Because server.conf and datanode.conf each define an independent connection to MongoDB, both files must reference the same authenticated user and be updated together. If you update one file without the other, the component you did not update cannot authenticate once access control is enforced. Apply these changes and restart both services within the same maintenance window to avoid a partial, broken configuration.

Create or Update the MongoDB Graylog User

Graylog connects to MongoDB as a dedicated user, separate from your MongoDB administrator account. This user must exist and hold the correct roles before Graylog can authenticate.

Assign the following roles to the Graylog MongoDB user:
- readWrite: Allows Graylog to read and write its own application data in MongoDB. This role is required for Graylog to start and operate, whether you are setting up a new cluster or adding authentication to an existing one.
- dbAdmin: Allows the user to change MongoDB profiling settings.
- clusterMonitor: Allows the user to read node statistics.
To create the Graylog user and grant it the required roles on a new installation, run the following command:
Copy
```
mongosh -u adminUser -p --authenticationDatabase admin --eval 'db.getSiblingDB("graylog").createUser({ user: "graylog", pwd: "<setPassword>", roles: [{ role: "readWrite", db: "graylog" }, { role: "dbAdmin", db: "graylog" }, { role: "clusterMonitor", db: "admin" }] })'
```
Replace <setPassword> with a secure password that meets your organization's password policy. You are prompted to enter the password for adminUser before the command runs.

If the Graylog user already exists, grant the required roles to that user instead of completing the preceding steps. Run the following command:
Copy
```
mongosh -u adminUser -p --authenticationDatabase admin --eval 'db.getSiblingDB("graylog").grantRolesToUser("graylog", [{ role: "readWrite", db: "graylog" }, { role: "dbAdmin", db: "graylog" }, { role: "clusterMonitor", db: "admin" }])'
```

Update the MongoDB Connection String

The mongodb_uri property controls how Graylog and Data Node connect to MongoDB. This property must be set in both server.conf and datanode.conf on every node.

Open server.conf (default location /etc/graylog/server/server.conf).

Set mongodb_uri to include the graylog user's credentials:

Copy

mongodb_uri = mongodb://graylog:<password>@<mongo-server-hostname>:27017/graylog?authSource=graylog

Replace <password> with the password you set for the graylog user, and replace <mongo-server-hostname> with your MongoDB hostname. For a multi-node MongoDB replica set, include all members in the URI as described in the MongoDB documentation.
Open datanode.conf (default location /etc/graylog/datanode/datanode.conf) and set the same mongodb_uri value.
Repeat these steps on every Graylog node and data node in your deployment.
Restart the Graylog server and Data Node services on each node.

Troubleshooting and Common Issues

The following section outlines troubleshooting steps for common issues to assist you in resolving potential challenges you may encounter.

Issue: Graylog Fails to Start After Enabling MongoDB Authentication

After configuring MongoDB authentication, the Graylog server repeatedly throws an exception and never starts.

Solution: Add the Missing readWrite Role

This happens when the Graylog MongoDB user is missing the readWrite role. A user with only clusterMonitor and dbAdmin can monitor the cluster but cannot read or write Graylog data, which Graylog requires to start. To add the missing role, follow the steps in Create or Update the MongoDB Graylog User, then restart Graylog.