Dockerized Greylog & Wazuh SIEM

I already have a bare-bones docker-compose.yml that spins up Greylog, but the stack is incomplete and I’m stuck. What I need is a fully working SIEM environment that runs entirely in Docker and lets Wazuh read Greylog data for basic sharing purposes.

Scope
• Greylog must start cleanly together with its required MongoDB instance (this is the database I want Greylog to use for configuration and metadata).
• Syslog input should be enabled in Greylog so I can forward logs straight away.
• A Wazuh container has to join the same network and be configured to pull logs/events from Greylog—only simple data exchange is required, no complex correlation or automated alerting for now.
• Compose file(s) should stay readable, ideally split into logical sections or separate files if that makes maintenance easier.

Deliverables
1. Updated docker-compose.yml (and any companion files) that launches Greylog + MongoDB + Wazuh in one command.
2. Clear, step-by-step notes on how to bring the stack up, forward a sample syslog message, and confirm that Wazuh can see it inside its own dashboard.
3. Short troubleshooting tips for common container issues (ports, volumes, memory).

Acceptance
I’ll consider the job done when I can run docker-compose up, open Greylog and Wazuh in the browser, send a test syslog line, and verify it appears in both tools.

Feel free to suggest minor tweaks, but please stay within the basic data-sharing requirement between Wazuh and Greylog.