Sign inSign up

nmeyer99/logboq-core

By nmeyer99

•Updated 26 days ago

Image
Monitoring & observability
0

430

nmeyer99/logboq-core repository overview

Test:

⁠Logboq-core (Frontend)

A modular event and log server written in Go. Nehebkau receives JSON-based Syslog and SNMP trap events over HTTP, normalizes them, and stores them in PostgreSQL, the local filesystem, or S3-compatible storage.

⁠Features

  • JSON event ingestion via POST /ingest
  • Syslog and SNMP trap normalization
  • PostgreSQL, filesystem, and S3 storage
  • Configurable retention and gzip compression
  • Event correlation and alerting
  • LDAP and OIDC authentication support
  • Prometheus-compatible metrics
  • Optional TLS and mutual TLS
  • Health and readiness endpoints
  • Runs as an unprivileged user

⁠Supported tags

  • latest — latest stable release
  • <version> — a specific release, for example 1.2.0

For production deployments, use a fixed version instead of latest.

⁠Quick start with Docker Compose

Replace YOUR_DOCKERHUB_USER with the Docker Hub namespace containing the image.

services:
  logboq:
    image: nmeyer99/logboq-core:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "8080:8080"
    environment:
      LOGBOQ_BOOTSTRAP_ADMIN_USERNAME: admin
      LOGBOQ_BOOTSTRAP_ADMIN_PASSWORD: logboq-admin
      LOGBOQ_BOOTSTRAP_ADMIN_DISPLAY_NAME: Administrator
    volumes:
      - ./data:/app/data
      - ./config:/app/etc
      - ./content-packs:/app/packs
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/healthz | grep -q ok"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s

  logboq-frontend:
    image: nmeyer99/logboq-frontend:latest
    container_name: logboq_frontend
    user: "${LOGBOQ_UID:-1000}:${LOGBOQ_GID:-1000}"
    restart: unless-stopped
    depends_on:
      logboq:
        condition: service_healthy
    ports:
      - "8081:8081"
    volumes:
      - ./etc:/app/etc
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8081/healthz | grep -q ok"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s


  db:
    image:  postgres:latest
    restart: unless-stopped
    environment:
      POSTGRES_USER: logboq
      POSTGRES_PASSWORD: logboq
      POSTGRES_DB: logboq
    volumes:
      - ./postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s

Start the services:

docker compose up -d

⁠Send an example event

curl -X POST http://localhost:8080/ingest \
  -H "Content-Type: application/json" \
  -d '{
    "type": "syslog",
    "timestamp": "2026-06-19T10:11:12Z",
    "host": "router-1",
    "ip": "10.0.0.5",
    "severity": 3,
    "priority": 27,
    "facility": 3,
    "tag": "sshd",
    "message": "login failed"
  }'

A successful request returns HTTP status 202 Accepted.

⁠Endpoints

  • POST /ingest — ingest events
  • GET /healthz — liveness check
  • GET /readyz — readiness check
  • GET /metrics — Prometheus metrics

⁠Configuration

Configuration files are loaded from /app/etc. Persistent application data is stored under /app/data.

docker run --rm \
  -p 8080:8080 \
  -v "$PWD/config:/app/etc" \
  -v "$PWD/data:/app/data" \
  YOUR_DOCKERHUB_USER/nehebkau-core:latest

The main configuration file must be available at:

/app/etc/config.ini

Additional configuration files can include:

/app/etc/rules.ini
/app/etc/targets.ini
/app/etc/smtp.ini
/app/etc/labels.ini

⁠Security

Always change bootstrap credentials before the first production start. Enable an ingest authentication token, TLS, or mutual TLS when exposing the service outside a trusted network.

⁠Source

Tag summary

Content type

Image

Digest

sha256:bb96c69f6…

Size

20.6 MB

Last updated

26 days ago

docker pull nmeyer99/logboq-core