docker-compose.yml

---
version: '3.6'
services:
  # The environment variable "TAG" is used throughout this file to
  # specify the version of the images to run. The default is set in the
  # '.env' file in this folder. It can be overridden with any normal
  # technique for setting environment variables, for example:
  #
  #   TAG=6.0.0-beta1 docker-compose up
  #
  # REF: https://docs.docker.com/compose/compose-file/#variable-substitution
  #
  # Also be sure to set the ELASTIC_VERSION variable. For released versions,
  # ${TAG} and ${ELASTIC_VERSION} will be identical, but for pre-release
  # versions, ${TAG} might contain an extra build identifier, like
  # "6.0.0-beta1-3eab5b40", so a full invocation might look like:
  #
  #   ELASTIC_VERSION=6.0.0-beta1 TAG=6.0.0-beta1-3eab5b40 docker-compose up
  #
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:${TAG}
    container_name: elasticsearch
    ports: ['9200:9200']
    networks: ['stack']
    volumes:
      - 'es_config:/usr/share/elasticsearch/config/'
      - 'certs:/usr/share/elasticsearch/config/certs'
      - 'ls_config:/logstash'
      - 'kb_config:/kibana'
      - 'es_data:/usr/share/elasticsearch/data'
      - './scripts/setup-users.sh:/usr/local/bin/setup-users.sh:ro'
      - './scripts/setup-elasticsearch.sh:/usr/local/bin/setup-elasticsearch.sh:ro'
      - './config/instances.yml:/usr/share/elasticsearch/config/certs/ssl/instances.yml'
      - './config/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml'
    healthcheck:
      test: curl --cacert /usr/share/elasticsearch/config/certs/ca/ca.crt -s https://localhost:9200 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
      interval: 30s
      timeout: 10s
      retries: 5

  kibana:
    image: docker.elastic.co/kibana/kibana:${TAG}
    container_name: kibana
    ports: ['5601:5601']
    networks: ['stack']
    volumes:
      - 'kb_config:/usr/share/kibana/config'
      - 'kb_data:/usr/share/kibana/data/'
      - 'certs:/certs'
      - './config/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml'
      - './scripts/setup-kibana.sh:/usr/local/bin/setup-kibana.sh:ro'
    depends_on: ['elasticsearch']
    healthcheck:
      test: curl --cacert /usr/share/elasticsearch/config/certs/ca/ca.crt -s https://localhost:5601 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
      interval: 30s
      timeout: 10s
      retries: 5

  logstash:
    image: docker.elastic.co/logstash/logstash:${TAG}
    container_name: logstash
    networks: ['stack']
    volumes:
      - 'ls_config:/usr/share/logstash/config'
      - 'certs:/certs'
      - './config/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml'
      - './config/logstash/pipelines.yml:/usr/share/logstash/config/pipelines.yml'
      - './config/logstash/pipeline/logstash.conf:/usr/share/logstash/pipeline/logstash.conf'
      - './scripts/setup-logstash.sh:/usr/local/bin/setup-logstash.sh:ro'
    depends_on: ['elasticsearch']
    healthcheck:
      test: bin/logstash -t
      interval: 60s
      timeout: 50s
      retries: 5

  auditbeat:
    image: docker.elastic.co/beats/auditbeat:${TAG}
    container_name: auditbeat
    hostname: auditbeat
    command: -e -c=config/auditbeat.yml # -e flag to log to stderr and disable syslog/file output
    cap_add: ['AUDIT_CONTROL', 'AUDIT_READ']
    # Auditbeat must run in the main process namespace.
    pid: host
    volumes:
      - 'ab_config:/usr/share/auditbeat/config'
      - 'certs:/certs'
      - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
      - './config/auditbeat/auditbeat.yml:/usr/share/auditbeat/config/auditbeat.yml'
    networks: ['stack']
    depends_on: ['elasticsearch', 'kibana']
    healthcheck:
      test: auditbeat --strict.perms=false test config
      interval: 30s
      timeout: 15s
      retries: 5

  filebeat:
    image: docker.elastic.co/beats/filebeat:${TAG}
    container_name: filebeat
    hostname: filebeat
    command: --strict.perms=false -e -c=config/filebeat.yml # -e flag to log to stderr and disable syslog/file output
    # If the host system has logs at "/var/log", mount them at "/mnt/log"
    # inside the container, where Filebeat can find them.
    # volumes: ['/var/log:/mnt/log:ro']
    volumes:
      - 'fb_config:/usr/share/filebeat/config'
      - 'certs:/certs'
      - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
      - './config/filebeat/filebeat.yml:/usr/share/filebeat/config/filebeat.yml'
    networks: ['stack']
    depends_on: ['elasticsearch', 'kibana']
    healthcheck:
      test: filebeat test config
      interval: 30s
      timeout: 15s
      retries: 5

  heartbeat:
    image: docker.elastic.co/beats/heartbeat:${TAG}
    container_name: heartbeat
    hostname: heartbeat
    command: --strict.perms=false -e -c=config/heartbeat.yml # -e flag to log to stderr and disable syslog/file output
    volumes:
      - 'hb_config:/usr/share/heartbeat/config'
      - 'certs:/certs'
      - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
      - './config/heartbeat/heartbeat.yml:/usr/share/heartbeat/config/heartbeat.yml'
    networks: ['stack']
    depends_on: ['elasticsearch', 'kibana']
    healthcheck:
      test: heartbeat test config
      interval: 30s
      timeout: 15s
      retries: 5

  metricbeat:
    image: docker.elastic.co/beats/metricbeat:${TAG}
    container_name: metricbeat
    hostname: metricbeat
    # The commented sections below enable Metricbeat to monitor the Docker host,
    # rather than the Metricbeat container. It's problematic with Docker for
    # Windows, however, since "/proc", "/sys" etc. don't exist on Windows.
    # The same likely applies to OSX (needs testing).
    # volumes:
    #   - /proc:/hostfs/proc:ro
    #   - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
    #   - /:/hostfs:ro
    command: --strict.perms=false -e -c=config/metricbeat.yml # -e flag to log to stderr and disable syslog/file output
    volumes:
      - 'mb_config:/usr/share/metricbeat/config'
      - 'certs:/certs'
      - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
      - './config/metricbeat/metricbeat.yml:/usr/share/metricbeat/config/metricbeat.yml'
    networks: ['stack']
    depends_on: ['elasticsearch', 'kibana']
    healthcheck:
      test: metricbeat test config
      interval: 30s
      timeout: 15s
      retries: 5

  packetbeat:
    image: docker.elastic.co/beats/packetbeat:${TAG}
    container_name: packetbeat
    hostname: packetbeat
    # Packetbeat needs some elevated privileges to capture network traffic.
    # We'll grant them with POSIX capabilities.
    cap_add: ['NET_RAW', 'NET_ADMIN']
    # Use "host mode" networking to allow Packetbeat to capture traffic from
    # the real network interface on the host, rather than being isolated to the
    # container's virtual interface.
    network_mode: host
    # Since we did that, Packetbeat is not part of the "stack" Docker network
    # that the other containers are connected to, and thus can't resolve the
    # hostname "elasticsearch". Instead, we'll tell it to find Elasticsearch
    # on "localhost", which is the Docker host machine in this context.
    depends_on: ['elasticsearch']
    command: --strict.perms=false -e -c=/usr/share/packetbeat/config/packetbeat.yml # -e flag to log to stderr and disable syslog/file output
    volumes:
      - 'pb_config:/usr/share/packetbeat/config'
      - 'certs:/certs'
      - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
      - './config/packetbeat/packetbeat.yml:/usr/share/packetbeat/config/packetbeat.yml'
    depends_on: ['elasticsearch', 'kibana']
    healthcheck:
      test: packetbeat test config
      interval: 30s
      timeout: 15s
      retries: 5

  apm-server:
    image: docker.elastic.co/apm/apm-server:${TAG}
    container_name: apm_server
    hostname: apm-server
    ports: ['8200:8200']
    networks: ['stack']
    command: --strict.perms=false -e -c=/usr/share/apm-server/config/apm-server.yml # -e flag to log to stderr and disable syslog/file output
    volumes:
      - 'apm_config:/usr/share/apm-server/config'
      - 'certs:/certs'
      - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
      - './config/apm-server/apm-server.yml:/usr/share/apm-server/config/apm-server.yml'
    depends_on: ['elasticsearch', 'kibana']
    healthcheck:
      test: curl --cacert /usr/share/apm-server/config/ca/ca.crt -s https://localhost:8200/healthcheck >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
      interval: 30s
      timeout: 10s
      retries: 5

networks: {stack: {}}
# use docker volume to persist ES data outside of a container.
volumes:
  certs:
  es_data:
  es_config:
  kb_config:
  kb_data:
  ls_config:
  ab_config:
  fb_config:
  hb_config:
  mb_config:
  pb_config:
  apm_config: