Create the Graylog server using debian 10. Replace 192.168.1.114 with your Graylog server IP below and pay attention to the echos:

# graylog server on deb10
apt-get update && apt-get upgrade -y
apt-get install apt-transport-https openjdk-11-jre-headless uuid-runtime pwgen dirmngr curl
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 4B7C549A058F8B6B
echo "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/4.2 main" | tee /etc/apt/sources.list.d/mongodb-org-4.2.list
apt-get update && apt-get install mongodb-org -y
systemctl daemon-reload
systemctl enable mongod.service
systemctl restart mongod.service
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add -
echo "deb https://artifacts.elastic.co/packages/oss-6.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-6.x.list
apt-get update && apt-get install elasticsearch-oss -y
echo "cluster.name: graylog" >> /etc/elasticsearch/elasticsearch.yml
echo "action.auto_create_index: false" >> /etc/elasticsearch/elasticsearch.yml
systemctl daemon-reload
systemctl enable elasticsearch.service
systemctl restart elasticsearch.service
wget https://packages.graylog2.org/repo/packages/graylog-3.1-repository_latest.deb
dpkg -i graylog-3.1-repository_latest.deb
apt-get update && apt-get install graylog-server -y
echo "for admin password as password and hash edit /etc/graylog/server/server.conf and set..."
echo "password_secret = naln41C22HRxw3hy9mJ8bipFWBo1aewKFgtXDXp22dNjNJNqEtid6uC0476zIfX5iQ3mZuRp9y7h3XcNY63inPo6vJy7FuLP"
echo "root_password_sha2 = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8"
echo "http_bind_address = 192.168.1.114:9000"
echo "http_publish_uri = http://192.168.1.114:9000"
systemctl enable graylog-server.service
systemctl start graylog-server.service

graylog webui should be up on http://192.168.1.114:9000 now. create a GELF UDP input using the default port 12201.

# add fluentd on graylog server
apt-get install sudo ntp ntpdate ntpstat ruby-gelf
curl -L https://toolbelt.treasuredata.com/sh/install-debian-buster-td-agent3.sh
systemctl daemon-reload
systemctl enable td-agent
td-agent-gem install gelf
cd /etc/td-agent/plugin
wget https://raw.githubusercontent.com/emsearcy/fluent-plugin-gelf/master/lib/fluent/plugin/out_gelf.rb
cd ../

Append to /etc/td-agent/td-agent.conf ...

<source>
type syslog
tag hostname_goes_here
</source>
<match *.*>
type copy
<store>
type gelf
host 0.0.0.0
port 12201
flush_interval 5s
</store>
<store>
type stdout
</store>
</match>

systemctl restart td-agent


On the sipXcom or Uniteme server(s), replace 192.168.2.14 with your sipxcom or uniteme server IP ...

# fluentbit on sipx/uniteme centos7
cd /etc/yum.repos.d/
nano fluentbit.repo

[fluentbit]
name = fluentbit
baseurl = http://packages.fluentbit.io/centos/7
gpgcheck=1
gpgkey=http://packages.fluentbit.io/fluentbit.key
enabled=1

yum update
yum install td-agent-bit -y
mv /etc/td-agent-bit/td-agent-bit.conf ~/td-agent-bit.conf.orig
nano /etc/td-agent-bit/td-agent-bit.conf

[INPUT]
Name cpu
Tag cpu.local
Interval_Sec 1

[INPUT]
Name mem
Tag memory

[INPUT]
Name disk
Tag disk.local
Interval_Sec 1

[INPUT]
Name netif
Tag netif.eth0
Interval_Sec 1
Interface eth0

[INPUT]
Name health
Tag health.proxy
Host 192.168.2.14
Port 5060
Interval_Sec 60
Alert true
Add_Host true
Add_Port true

[INPUT]
Name health
Tag health.registrar
Host 192.168.2.14
Port 5070
Interval_Sec 60
Alert true
Add_Host true
Add_Port true

[INPUT]
Name health
Tag health.bridge
Host 192.168.2.14
Port 5090
Interval_Sec 60
Alert true
Add_Host true
Add_Port true

[INPUT]
Name health
Tag health.mongo
Host 127.0.0.1
Port 27017
Interval_Sec 60
Alert true
Add_Host true
Add_Port true

[INPUT]
Name health
Tag health.pgsql
Host 127.0.0.1
Port 5432
Interval_Sec 60
Alert true
Add_Host true
Add_Port true

[INPUT]
Name health
Tag health.dns
Host 127.0.0.1
Port 53
Interval_Sec 60
Alert true
Add_Host true
Add_Port true

[INPUT]
Name tail
Path /var/log/sipxpbx/proxy_stats.json
Refresh_Interval 1
Parser json

[OUTPUT]
Name forward
Match *
Host 192.168.1.114
Port 24224

service td-agent-bit restart