Configure Graylog to Use MongoDB Password Authentication

Graylog stores its metadata and configuration data in MongoDB. By default, Graylog connects to MongoDB without authentication, but you can secure this connection with a dedicated MongoDB user and password. This article explains how to create the required MongoDB user with the correct roles and how to point Graylog at an authenticated connection. The steps apply whether you are setting up a new cluster or adding authentication to an existing one.

This topic covers authenticating Graylog's connection to MongoDB. If you're only looking to grant a user permission to view MongoDB node metrics on the Cluster Configuration page, see Roles and Permissions for MongoDB Access instead.

Important: The MongoDB user Graylog connects with must include the readWrite role in addition to any monitoring-related roles. A user missing readWrite cannot read or write Graylog's data, which prevents Graylog from starting.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

  • MongoDB is installed and reachable from every Graylog and Data Node host.

  • You have administrator credentials for MongoDB (a user with permission to create users and grant roles, such as one holding the userAdmin or root role on the admin database).

  • You have access to edit server.conf and datanode.conf on every node, and permission to restart the Graylog and Data Node services.

Contextual Information

This guide assumes MongoDB access control (authorization enforcement) is already enabled on your MongoDB deployment, or that you're prepared to enable it immediately after completing this configuration. Enabling access control on the MongoDB server itself, for example by setting security.authorization: enabled in mongod.conf, is a MongoDB administration task and isn't covered in this article; refer to MongoDB documentation for that step.

Because server.conf and datanode.conf each define an independent connection to MongoDB, both files must reference the same authenticated user and be updated together. Updating one without the other leaves the unmodified component unable to authenticate once access control is enforced, so plan to apply these changes and restart both services within the same maintenance window to avoid a partial, broken configuration.

Create or Update the MongoDB Graylog User

The Graylog MongoDB user must be assigned the following roles:

  • readWrite: Allows Graylog to read and write its own application data in MongoDB. This role is required for Graylog to start and operate, whether you are setting up a new cluster or adding authentication to an existing one.

  • dbAdmin: Allows the user to change MongoDB profiling settings.

  • clusterMonitor: Allows the user to read node statistics.

  1. To create the Graylog user and grant it the required roles for a new installation, run the following command:

    Copy 
    mongosh -u adminUser -p --authenticationDatabase admin --eval 'use graylog; db.createUser({ user: "graylog", pwd: "<setPassword>", roles: [{ role: "readWrite", db: "graylog" }, { role: "dbAdmin", db: "graylog" }, { role: "clusterMonitor", db: "admin" }] })'

  2. Replace <setPassword> with a secure password that meets your organization's password policy. You are prompted to enter the password for adminUser before the command runs.

  3. To grant the required roles to a Graylog user that already exists, run the following command instead:

    Copy 
    mongosh -u adminUser -p --authenticationDatabase admin --eval 'use graylog; db.grantRolesToUser("graylog", [{ role: "readWrite", db: "graylog" }, { role: "dbAdmin", db: "graylog" }, { role: "clusterMonitor", db: "admin" }])'

Update the MongoDB Connection String

The mongodb_uri property controls how Graylog and Data Node connect to MongoDB. This property must be set in both server.conf and datanode.conf, on every node.

  1. Open server.conf (default location /etc/graylog/server/server.conf).

  2. Set mongodb_uri to include the graylog user's credentials:

    Copy 
    mongodb_uri = mongodb://graylog:<password>@localhost:27017/graylog

  3. Replace <password> with the password you set for the graylog user, and replace localhost:27017 with your MongoDB host and port. For a multi-node MongoDB replica set, include all members in the URI as described in the MongoDB documentation.

  4. Open datanode.conf (default location /etc/graylog/datanode/datanode.conf) and set the same mongodb_uri value.

  5. Repeat these steps on every Graylog and Data Node in your deployment.

  6. Restart the Graylog server and Data Node services on each node.

Troubleshooting and Common Issues

The following section outlines troubleshooting steps for common issues to assist you in resolving potential challenges you may encounter.

Issue: Graylog Fails to Start After Enabling MongoDB Authentication

After configuring MongoDB authentication, the Graylog server repeatedly throws an exception and never starts.

Solution: Add the Missing readWrite Role

This happens when the Graylog MongoDB user is missing the readWrite role. A user with only clusterMonitor and dbAdmin can monitor the cluster but cannot read or write Graylog's data, which Graylog requires to start. Follow the steps in the Create or Update the MongoDB Graylog User section above to add the missing role, then restart Graylog.

Further Reading

Explore the following additional resources and recommended readings to expand your knowledge on related topics: