docker-compose-elk.yml

version: '3.2'

services:
  elasticsearch:
    build:
      context: elasticsearch/
      args:
        ELK_VERSION: $ELK_VERSION
    restart: unless-stopped
    container_name: elk_elasticsearch
    labels:
      local.elk: true
    volumes:
      - type: bind
        source: ./elasticsearch/config/elasticsearch.yml
        target: /usr/share/elasticsearch/config/elasticsearch.yml
        read_only: true
      - type: bind
        source: ./data
        target: /usr/share/elasticsearch/data
    environment:
      ES_JAVA_OPTS: "-Xmx4g -Xms1g -Xss8m"
      ELASTIC_PASSWORD: changeme
      # Use single node discovery in order to disable production mode and avoid bootstrap checks
      # see https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
      discovery.type: single-node
    networks:
      - elk

  logstash:
    build:
      context: logstash/
      args:
        ELK_VERSION: $ELK_VERSION
    restart: unless-stopped
    container_name: elk_logstash
    labels:
      local.elk: true
    volumes:
      - type: bind
        source: ./logstash/config/logstash.yml
        target: /usr/share/logstash/config/logstash.yml
        read_only: true
      - type: bind
        source: ./logstash/pipeline
        target: /usr/share/logstash/pipeline
        read_only: true
    environment:
      LS_JAVA_OPTS: "-Xmx1g -Xms512m -Xss4m"
    networks:
      - elk
    depends_on:
      - elasticsearch

  kibana:
    build:
      context: kibana/
      args:
        ELK_VERSION: $ELK_VERSION
    restart: unless-stopped
    container_name: elk_kibana
    labels:
      local.elk: true
    volumes:
      - type: bind
        source: ./kibana/config/kibana.yml
        target: /usr/share/kibana/config/kibana.yml
        read_only: true
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - elasticsearch

  logspout:
    image: gliderlabs/logspout:v3.2.11
    restart: unless-stopped
    container_name: elk_logspout
    labels:
      local.elk: true
    command: 'udp://logstash:5000'
    links:
      - logstash
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock
    environment:
      RAW_FORMAT: '{ "container" : "{{ .Container.Name }}", "labels": {{ toJSON .Container.Config.Labels }}, "timestamp": "{{ .Time.Format "2006-01-02T15:04:05.000000Z07:00" }}", "source" : "{{ .Source }}", "message": {{ toJSON .Data }} }'
      ALLOW_TTY: 'true'
      EXCLUDE_LABELS: "${LOGSPOUNT_EXCLUDE_LABELS}"
    networks:
      - elk
    depends_on:
      - logstash

networks:
  elk:
    driver: bridge