Current Docker Image on Docker Mac Not Receiving Messages

I’m trying to get Graylog working on a Mac with Docker. I did the following this morning:

  1. Downloaded the latest version of Docker for Mac, and started it
  2. Created a new directory, and created a docker-compose.yml file by copying the sample in the ‘Persisting Data’ section of the docs here:
  3. Edited that file slightly to add support for the text logging port, 5555, via UDP by adding:


  • 5555:5555/udp

below the GELF UDP line.
4. Started the image
5. Logged in as admin, and created a UDP text listener bound to localhost on port 5555
6. Tried to use NC to push messages to the log as follows:

Eric-MBP:Docker ericw$ echo 'Hello Graylog!' | nc -u localhost 5555
Eric-MBP:Docker ericw$ echo 'This is a test' | nc -u localhost 5555
Eric-MBP:Docker ericw$ echo 'I am curious if it will work' | nc -u localhost 5555
Eric-MBP:Docker ericw$ echo 'Hello Graylog!' | nc localhost 5555
Eric-MBP:Docker ericw$ echo 'This is a test' | nc localhost 5555
Eric-MBP:Docker ericw$ echo 'I am curious if it will work' | nc localhost 5555

Graylog GUI shows 0 messages for the input on the input screen, and on the search screen. Based on a forum search, I also tried searching by absolute criteria, with a date range that included two days in the past and two days in the future, and get nothing.

Any clues as to what I might be doing wrong would be appreciated. Actual docker-compose.yml follows:

version: '2'
  # MongoDB:
    image: mongo:3
      - mongo_data:/data/db
  # Elasticsearch:
      - es_data:/usr/share/elasticsearch/data
      # Disable X-Pack security:
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
        soft: -1
        hard: -1
    mem_limit: 1g
  # Graylog:
    image: graylog/graylog:2.3.0-1
      - graylog_journal:/usr/share/graylog/data/journal
      # CHANGE ME!
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      # Password: admin
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - mongodb:mongo
      - elasticsearch
      - mongodb
      - elasticsearch
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 514:514
      # Syslog UDP
      - 514:514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp
      # Text
      - 5555:5555/udp
# Volumes for persisting data, see
    driver: local
    driver: local
    driver: local

None of the messages you’ve tried to send to Graylog is a valid GELF message.

See for working examples.

Jochen - thanks for replying. I am following documentation, please check here:

You’ll see that the send commands I was using were exactly what the documentation referenced above describes. I wasn’t trying to send in GELF messages, I was trying to send in plain text messages, which should be supported on port 5555 per the above documentation.

There was a difference in the link you provided, specifically piping to “nc -w0 -u localhost 5555” rather than “nc localhost 5555” in the documentation referenced above. That didn’t work at first either, but when I replaced localhost with, I started seeing messages. Weirdly, “ping localhost” responds with as expected, so I’m unclear why localhost does not work, and does.

In any case, the command provided in the documentation above does not work with either localhost or I don’t know if this is something specific to the nc implementation on MacOS, or whether it is a broader problem. Now that I have at least something working, I can proceed with further evaluation.

You may want to consider whether documentation adjustments for the docs referenced above are needed based on my experience.


The documentation you referenced is using a Raw/Plaintext TCP input, not a GELF UDP input which you have created according to your first post.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.