Graylog OS config and Opensearch install: https://projectblack.io/blog/automated-graylog-setup-using-puppet-2023/

1-manifest.pp

# Set timezone
class { 'timezone':
  timezone => 'UTC',
}
# Set NTP servers
class { 'ntp':
  servers => [ '0.au.pool.ntp.org', '1.au.pool.ntp.org', '2.au.pool.ntp.org', '3.au.pool.ntp.org'],
}

# Opensearch kernel config
sysctl { 
  'vm.max_map_count': value => '262144' 
}

# Opensearch setup and configuration
class { 'opensearch':
  version        => '2.11.0',
  settings       => {
    'cluster.name' => 'graylog',
    'network.host' => '127.0.0.1',
    'discovery.type' => 'single-node',
    'cluster.initial_cluster_manager_nodes' => '',
    'action.auto_create_index' => false,
    'plugins.security.ssl.http.enabled' => false
  },
  use_default_security_internal_users => false,
  security_internal_users => {
    _meta => {
      type => 'internalusers',
      config_version => 2
    },
    graylog_os_user => {
      hash    => '$2y$12$YXDnTz2S.phXzopgnNQsOuL.KSyHoAwMuiQjkcDc7N0INQTM4vYOq', #bcrypt hash for password
      reserved => true,
      backend_roles => [
        'admin',
      ],
      description   => 'Graylog admin user',
    }
  },
  heap_size => '4g'
}