Web UI tries to load / redirect docker ip address


Following the docker installation instructions, basically unaltered the docker-compose file with persistent data. The webUI isn’t loading and I see its trying to load or redirect to 172.19.0.something, which is the ip docker gave it internally.

I’ve done the searching but I end up with help pertaining to graylog2, not the latest version 3.0. The settings seem to have changed.

The docker-compose contains GRAYLOG_WEB_ENDPOINT_URI= I tried changing that to the IP the dockers are running on.

The graylog.conf contains the following:

#http_bind_address =
#http_publish_uri =
#http_external_uri = 

I tried uncommenting and changing each of those (one at a time) and despite the comments in the config file, it’s unclear to me what these do exactly. Fiddling about didn’t give me the result I’ve been after ;).

Could someone lay this out for me please what should these settings be if my host ip would be

Thanks in advance!

So even when I set everything to a fqdn pointing to my internal host ip address, it still tries to load the internal docker ip.
Here is my docker-compose file:

version: '2'
  # MongoDB: https://hub.docker.com/_/mongo/
    image: mongo:3
      - mongo_data:/data/db
  # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.5.4
      - es_data:/usr/share/elasticsearch/data
      - http.host=
      - transport.host=localhost
      - network.host=
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
        soft: -1
        hard: -1
    mem_limit: 1g
  # Graylog: https://hub.docker.com/r/graylog/graylog/
    image: graylog/graylog:3.0
      - graylog_journal:/usr/share/graylog/data/journal
      # CHANGE ME (must be at least 16 characters)!
      # Password: admin
      - GRAYLOG_ROOT_PASSWORD_SHA2=moreblablabla
      - GRAYLOG_WEB_ENDPOINT_URI=http://graylog.internal.mydomain.net:9000/api
      - mongodb:mongo
      - elasticsearch
      - mongodb
      - elasticsearch
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 514:514
      # Syslog UDP
      - 514:514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp
# Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/
    driver: local
    driver: local
    driver: local

and in my config/graylog.conf:

http_bind_address =
http_publish_uri = http://graylog.internal.mydomain.net:9000/

Sorry I keep adding info, but I’m still trying things out.

I noticed I was missing the config volume so I added

      - ./config:/usr/share/graylog/data/config

It then bails out it cannot set permissions on /usr/share/graylog/data/config.

So I added variables instead to the docker-compose:

      - GRAYLOG_ROOT_PASSWORD_SHA2=blablabla
      - GRAYLOG_WEB_ENDPOINT_URI=http://graylog.internal.mydomain.net:9000/api
      - GRAYLOG_PASSWORD_SECRET=moreblablabla
      - GRAYLOG_HTTP_PUBLISH_URI=http://graylog.internal.mydomain.net:9000/

It bails out:

2019-02-14 20:26:48,272 ERROR: org.graylog2.bootstrap.ServerBootstrap - Graylog startup failed. Exiting. Exception was:
java.lang.IllegalStateException: Expected to be healthy after starting. The following services are not running: {FAILED=[JerseyService [FAILED]]}
	at com.google.common.util.concurrent.ServiceManager$ServiceManagerState.checkHealthy(ServiceManager.java:741) ~[graylog.jar:?]
	at com.google.common.util.concurrent.ServiceManager$ServiceManagerState.awaitHealthy(ServiceManager.java:553) ~[graylog.jar:?]
	at com.google.common.util.concurrent.ServiceManager.awaitHealthy(ServiceManager.java:314) ~[graylog.jar:?]
	at org.graylog2.bootstrap.ServerBootstrap.startCommand(ServerBootstrap.java:148) [graylog.jar:?]
	at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:210) [graylog.jar:?]
	at org.graylog2.bootstrap.Main.main(Main.java:50) [graylog.jar:?]
	Suppressed: com.google.common.util.concurrent.ServiceManager$FailedService: JerseyService [FAILED]
	Caused by: java.net.BindException: Cannot assign requested address

It is time for bed.

Hopefully I’ll find some help here tomorrow :slight_smile:.

Thanks in advance!

No worries, you’re still learning. Just like many of us.

First question though: why Docker? From what I’m reading, I see you’re fighting with the same Docker networking concepts that I also don’t comprehend yet.

Is there a particular reason you’re opting for Docker? Or could you actually restart your work simply installing Graylog, Elastic and Mongo on “normal” VMs or systems? As you have noticed, Docker adds a layer of complexity which you may not need at this particular time :slight_smile:

It is time for bed.

Sleep tight! :sleeping:

1 Like

Thanks for your reply.

I run several docker containers, both comparable and more complex than this, without issues. It shouldn’t be difficult and I think I understand the concept. The reason for it is that I don’t want to have to deal with multiple applications requiring mongo databases, webservers, libraries, each having their own requirements in terms of configuration, versions and dependencies.

This problem isn’t a Docker one, it’s the Graylog configuration and documentation that I somehow fail to understand (respectfully, I think its lacking in this particular area).

1 Like

In that case, once we figure out what the issue is, please take a little time to improve the documentation where needed. It’s open-source on Github.

Do you recall which particular Docker containers you grabbed for your setup? I can imagine there being multiple variants of Graylog, Elastic and Mongo.

It’s in the docker-compose I posted. Current docker images are:

REPOSITORY                                          TAG                 IMAGE ID            CREATED             SIZE
graylog/graylog                                     3.0                 556c819a0a22        3 days ago          474MB
mongo                                               3                   2d6f175a24cf        9 days ago          361MB
docker.elastic.co/elasticsearch/elasticsearch-oss   6.5.4               c4f8af5c694e        8 weeks ago         645MB
1 Like

Oke so the web interface is suddenly working and I have no idea what’s different this time around.

The only thing required to get it to work is GRAYLOG_HTTP_PUBLISH_URI=http://graylog.internal.mydomain.net:9000/.

I am positive I had tried this before, but (guessing) I may have had a typo (forgot the trailing slash?).

Other issues now, logs littered with failures to connect. I’ll investigate first and if I need more help I’ll open a new topic with a proper title for it.

1 Like

you need to remove the old Settings GRAYLOG_WEB_ENDPOINT_URI and only use the new.

In this case also - read the upgrade docs and understand if changes have influence on your setup.

1 Like

Thanks Jan!

I didn’t upgrade, this is a new deployment based on the 3.0 documentation. This setting is taken from this page in particular.

Funny, I change that into - GRAYLOG_HTTP_EXTERNAL_URI=http://HOST-IP-ADDR:9000/ and it works flawlessly.

[In 1,042 / Out 1,042 msg/s] :smiley:

what a pitty that we have this in our docs …

Oh I’m sure it’s somewhere but obviously, it’s not where it’s expected to be.

When you’ll follow the 3.0 documentation from the start, and follow the Docker installation instructions, there is GRAYLOG_WEB_ENDPOINT_URI mentioned everywhere in the instructions and examples provided.



He has a point

Quick! To Github, so we can fix the page!

EDIT: I’ll do that when I get home… Can’t edit on Github from the office; don’t want to leave my personal creds here :slight_smile:


Somebody beat me to it.

Probably jan but he doesn’t want to admit it :wink:

Graylog is running great by the way. Uploaded systemd journals from 4 systems so far. Filtering and searching is really fast, impressive!

Oh no, don’t worry, he’s pretty darn cool. Just a bit too busy, what with the 3.0 release, which would have anyone running a bit ragged. The commit log shows that he and a colleague updated the docs. So in that regard: thank you very much for pointing out the mistake!

Good for you! That should make a nice start to the weekend, no?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.