I currently have the graylog version 3.1.01.8.0_222 on Linux 5.10.0-10-amd64 Debian ) installed with Docker-Compse below

version: '3.3'

services:
#
# monitoring
#
  prom:
    image: quay.io/prometheus/prometheus:v2.0.0
    restart: always
    volumes:
     - ./monitor/prometheus.yml:/etc/prometheus/prometheus.yml
    command: "--config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/prometheus"
    ports:
     - 9090:9090
    depends_on:
     - exporter
    logging:
      driver: gelf
      options:
        gelf-address: udp://192.168.100.100:12201

  exporter:
    image: prom/node-exporter:latest
    restart: always
    ports:
     - "9100:9100"
       #    network_mode: host
    logging:
      driver: gelf
      options:
        gelf-address: udp://192.168.100.100:12201

  grafana:
    restart: always
    image: grafana/grafana
    ports:
     - "3000:3000"
    depends_on:
    - prom
    volumes:
    - ./grafana_data:/var/lib/grafana
    logging:
      driver: gelf
      options:
        gelf-address: udp://192.168.100.100:12201


  cadvisor:
    image: google/cadvisor:latest
    container_name: monitoring_cadvisor
    restart: unless-stopped
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    expose:
      - 8080

#
# logserver
#
  graylog-mongo:
    image: "mongo:3"
    restart: always
    volumes:
    - ./graylog/mongodb:/data/db
    environment:
      - TZ=Asia/Tehran
      - AUTO_UPDATES_ON=true

  graylog-elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.2
    restart: always
    #command: "elasticsearch -Des.cluster.name='graylog'"
    volumes:
    - ./graylog/elasticsearchdata:/usr/share/elasticsearch/data
    ports:
    - 9200:9200
    environment:
      - TZ=Asia/Tehran
      - AUTO_UPDATES_ON=true
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - node.max_local_storage_nodes=4
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      # config added by da.na
      - elasticsearch_max_time_per_index=1d # limit 
      - elasticsearch_max_number_of_indices=8
      - indices.fielddata.cache.size=20%
      - elasticsearch_shards=1
      - elasticsearch_replicas=1
    ulimits:
      memlock:
        soft: -1
        hard: -1

  graylog:
    image: graylog/graylog:3.1
    restart: always
    volumes:
       - ./graylog/journal:/usr/share/graylog/data/journal
       - ./graylog/config:/usr/share/graylog/data/config
    environment:
      - TZ=Asia/Tehran
      - AUTO_UPDATES_ON=true
      - GRAYLOG_PASSWORD_SECRET=xxxxxxxxxx
      - GRAYLOG_ROOT_PASSWORD_SHA2=<.....>
      - GRAYLOG_WEB_ENDPOINT_URI=http://192.168.x.x:9000/api/
      - GRAYLOG_HTTP_BIND_ADDRESS=0.0.0.0:9000
      - GRAYLOG_HTTP_EXTERNAL_URI=http://192.168.x.x:9000/
      - GRAYLOG_TRANSPORT_EMAIL_WEB_INTERFACE_URL=http://192.168.x.x:9000
      - GRAYLOG_TRANSPORT_EMAIL_HOSTNAME=mail.eniac-tech.local
      - GRAYLOG_TRANSPORT_EMAIL_ENABLED=true
      - GRAYLOG_TRANSPORT_EMAIL_PORT=25
      - GRAYLOG_TRANSPORT_EMAIL_USE_AUTH=false
      - GRAYLOG_TRANSPORT_EMAIL_USE_TLS=false
      - GRAYLOG_TRANSPORT_EMAIL_USE_SSL=false
      - [email protected]
      - GRAYLOG_TRANSPORT_SUBJECT_PREFIX=[graylog]
    links:
      - graylog-mongo:mongo
      - graylog-elasticsearch:elasticsearch
    depends_on:
      - graylog-mongo
      - graylog-elasticsearch
    ports:
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 8514:8514
      # Syslog UDP
      - 8514:8514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp

and everyting is OK
And I intend to send Windows VM machine logs to this new server with winlogbeat for testing , But nothing is received in the Graylog server . I used winlogbeat , GELF 514 as well.
I am completlly confused and don’t know where the problem is.
I appreciate any ideas and suggestions.

I really appreciate the guidance and guidance
you can see at the end of docker-compose
I used port 12201 in winlogbeat config file.