# GrayLog Cluster with Wazuh Indexer & MongoDB **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [January 4, 2023, 7:04pm UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168 "2023-01-04T19:04:43Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![4xekb](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/4xekb/32/13841_2.png) [@4xekb](https://community.graylog.org/u/4xekb)\ **Post date:** [January 4, 2023, 7:04pm UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/1 "2023-01-04T19:04:43Z")
Dear Community, My 1st Post here, after I read quite a lot of Docs and Guides, still have two important issues I hope will not take too much Time of yours. I am incharge of building a SOC for several potential Customers of us, so kind as MSSP you could say. In our planned Stack: Wazuh with Wazuh Indexer (instead of ELK). GrayLog Grafana Misp/Opencti TheHive Velociraptor Debian 11 on Cloud, Ansible deployment. What we would be happy to get your input about: 1. It was clear after reading Guides and Docs that the Wazuh Indexer Cluster would be used for the Logs Storage, so Graylog \> Wazuh Indexer. Lately I hear some voices that it is not a good practice. Y? 2. I saw and read the GL Multi Node Guide, so, is this correct basic Cluster Setup, that will help us scale up rapidly when needed: - Wazuh Indexer 01 - Wazuh Indexer 02 - Wazuh Indexer 03 - Graylog Server 01 (and inside MongoDB) - Graylog Server 02 (and inside MongoDB) - Graylog Server 03 (and inside MongoDB) - MongoDB ReplicaSet 01 - MongoDB ReplicaSet 02 - MongoDB ReplicaSet 03 So in total, GL Cluster has 6 Machines. Is this the right direction? P.S. I am aware it all depends on i/o, CPU, Ram, number of Logs ingested ect - but as the last Variable is still to be declared, for now am looking on the basic Cluster. Thank you for any info ! Elad ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [January 4, 2023, 11:16pm UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/2 "2023-01-04T23:16:20Z")
Hello @4xekb Looking over you layout , it looks good but Graylog from version 4.3 → 5 will be using Opensearch which is a fork from Elasticsearch. I have not worked with _Wazuh_ to see if its compatable with Graylog after 5.0. I would be curious to see this setup thou. ---
**Author:** ![4xekb](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/4xekb/32/13841_2.png) [@4xekb](https://community.graylog.org/u/4xekb)\ **Post date:** [January 4, 2023, 11:29pm UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/3 "2023-01-04T23:29:46Z")
Thanks @gsmith for your prompt reply. As Wazuh Indexer is a Fork from OpenSearch, I am quite sure I saw somewhere the Compatability Matrix, I will look for it tomorow and post it here. If GL is not compatible with it, then we just use OpenSearch I guess. In that case - then the first 3 Machines I wrote, so indexer01,02,03 will just be the 3 machines for Opensearch1, 2, 3 ? Also, more important please, I just read again several mongoDB Docs but still am not sure about the Replica. As you can see in my List, there are 3 GL Servers, which AFAIK each should have a MongoDB instance inside. In addition, I also planned 3 Machines for 3 Replicas. Is that correct? I mean - ReplicaSet01 is all the time replicated from the MongoDB Instance inside my GrayLog Server 01? Hope my question makes sense and thanks again ! ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [January 4, 2023, 11:50pm UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/4 "2023-01-04T23:50:30Z")
Hey, For graylog you will need to configure mongo nodes in the configruation file with the replica set name. Might want to look here for a better idea. > **[Deploy a Replica Set — MongoDB Manual](https://www.mongodb.com/docs/manual/tutorial/deploy-replica-set/)** ---
**Author:** ![4xekb](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/4xekb/32/13841_2.png) [@4xekb](https://community.graylog.org/u/4xekb)\ **Post date:** [January 5, 2023, 12:08am UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/5 "2023-01-05T00:08:05Z")
Hemm, sorry, did not get ur point. I did read this Guide before, and still dont understand, also ur comment - what is not good in my Plan. I have 3 Machines, each has GL Server + MongoDB. Then I have 3 extra Machines, with Replica Set 01,02,03 What do i miss? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [January 5, 2023, 12:53am UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/6 "2023-01-05T00:53:43Z")
Hey @4xekb Perhaps I can try to simplify it for you. > [@4xekb](#): > > I have 3 Machines, each has GL Server + MongoDB. > Then I have 3 extra Machines, with Replica Set 01,02,03 If I understand you correct, those first three /w Graylog nodes would be a replica set, you would have a primary and two secondary nodes, so your Graylog config file would show the following. **Example** ```auto #mongodb_uri = mongodb://node1:27017,node2:27017,node3:27017/graylog?replicaSet=rs01 ``` To add the other three you would need to find you primary MongoDb node and add them. **Example** : ```auto # Edit the Mongo configuration file. vi /etc/mongod.conf ``` ```auto # Edit the following values in mongod.conf. # Replace mongo-node-1.domain.com with the fully qualified domain name of the current Mongo node, and mongoReplicaSet with your own. net: port: 27017 bindIp: 127.0.0.1,mongo-node-1.domain.com replication: replicaSetName: mongoReplicaSet ``` **Or** ```auto # Enter the following command to create the replica set. > rs.initiate() # Enter the following command to add other nodes, where the other node is named, # for example, "mongo-node-2" and the domain is domain.com. > rs.add("mongo-node-2.domain.com") ``` **Verify the Replica Configuration** ```auto mongoReplicaSet:PRIMARY> rs.conf() { "_id" : "mongoReplicaSet", "version" : 3, "protocolVersion" : NumberLong(1), "writeConcernMajorityJournalDefault" : true, "members" : [ { "_id" : 0, "host" : "mongo-node-1.domain.com:27017", "arbiterOnly" : false, "buildIndexes" : true, "hidden" : false, "priority" : 1, "tags" : { }, "slaveDelay" : NumberLong(0), "votes" : 1 }, { "_id" : 1, "host" : "mongo-node-2.domain.com:27017", "arbiterOnly" : false, "buildIndexes" : true, "hidden" : false, "priority" : 1, "tags" : { }, "slaveDelay" : NumberLong(0), "votes" : 1 }, { "_id" : 2, "host" : "mongo-node-3.domain.com:27017", "arbiterOnly" : false, "buildIndexes" : true, "hidden" : false, "priority" : 1, "tags" : { }, "slaveDelay" : NumberLong(0), "votes" : 1 } ], "settings" : { "chainingAllowed" : true, "heartbeatIntervalMillis" : 2000, "heartbeatTimeoutSecs" : 10, "electionTimeoutMillis" : 10000, "catchUpTimeoutMillis" : -1, "catchUpTakeoverDelayMillis" : 30000, "getLastErrorModes" : { }, "getLastErrorDefaults" : { "w" : 1, "wtimeout" : 0 }, "replicaSetId" : ObjectId("5d1e36618481a2906eb97171") } } ``` This is found here. > **[Replica Set Members — MongoDB Manual](https://www.mongodb.com/docs/manual/core/replica-set-members/)** > **[Replica Set Elections — MongoDB Manual](https://www.mongodb.com/docs/manual/core/replica-set-elections/)** Conclusion: If you need all 6 MongoDb instance to work together (cluster) then there will be a primary and secondary instances. OR if those Graylog server /w Mongo are separtate and your trying to use the replicate set for backup you may want to rethink you layout. It’s possible you could use a different database name for each one of the individual Graylog servers i.e., graylog1.db, graylog2.db,etc… ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [January 5, 2023, 1:10am UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/7 "2023-01-05T01:10:12Z")
@4xekb Actually there is someone here that used/using Wazuh, perhaps he could jump in. > [@Integrating wazuh indexer with Graylog](https://community.graylog.org/t/integrating-wazuh-indexer-with-graylog/26430): > > Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describe your incident: I am integrating Graylog with wazuh indexer The indexer working as expected. 2. Describe your environment: OS Information: hostnamectl Static hostname: soclab Icon name: computer-vm Chassis: vm Machine ID: b05f434d05e54eb08a2452dfc2b2d5a4 Boot ID: 23c… ---
**Author:** ![H077E](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/h077e/32/15231_2.png) [@H077E](https://community.graylog.org/u/H077E)\ **Post date:** [January 6, 2023, 10:08am UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/8 "2023-01-06T10:08:47Z")
Hey @4xekb it’s a little off topic… you wrote that you want to set up an MSSP with SOC. What are the use cases for WAZUH? And a hint, from TheHIVE 5 you need an MSSP license. With the introduction of version 5, StrangeBee changed the license model. ---
**Author:** ![ramindia](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ramindia/32/5085_2.png) [@ramindia](https://community.graylog.org/u/ramindia)\ **Post date:** [January 7, 2023, 10:47am UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/9 "2023-01-07T10:47:09Z")
Sure why not, so far the integration looks good, I am getting what I was looking to deploy. user do message my personal message I replied with the environment that I am running if required happy to help. it also helps different views of how people look to deploy. ---
**Author:** ![4xekb](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/4xekb/32/13841_2.png) [@4xekb](https://community.graylog.org/u/4xekb)\ **Post date:** [January 10, 2023, 10:42am UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/10 "2023-01-10T10:42:42Z")
Hi, Sorry i missed ur msg. Wazuh is a very enriched Platform, SIEM/EDR and more. I actually used it in the past and was very happy with. The list is huge but basically deploy Wazuh on Agents, forward the Logs, FIM, Inventory, CVE Detection and much more. Regarding the Hive5, yes i know, thanks, we should get a License soon . Are u using similar Stack ? ---
**Author:** ![H077E](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/h077e/32/15231_2.png) [@H077E](https://community.graylog.org/u/H077E)\ **Post date:** [January 10, 2023, 11:00am UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/11 "2023-01-10T11:00:42Z")
Hey, Thanks for your answer. I have built and managed a SOC in the government environment for several years and know the ups and downs 😉 I had deployed QRadar as a large distributed system. At some point I stopped having fun with a closed proprietary system. The setting consisted of QRadar, TheHive, OpenCTI, MISP, OTRS and a lot of hand made (python-)applications. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 24, 2023, 11:00am UTC](https://community.graylog.org/t/graylog-cluster-with-wazuh-indexer-mongodb/27168/12 "2023-01-24T11:00:56Z")
Closed on January 24, 2023, 11:00am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.