dansta/docker-elastic-stack

ELK Stack Dockerfile

Elastic Stack Dockerfile

This repository contains a Dockerfile of the Elastic Stack.

Dependencies

• alpine:3.7
• openjdk8-jre
• Elasticsearch
• Logstash
• Kibana

Image Tags

$ docker images

REPOSITORY                    TAG                 VIRTUAL SIZE
blacktop/elastic-stack        latest              698MB
blacktop/elastic-stack        6.2                 698MB
blacktop/elastic-stack        6.1                 620MB
blacktop/elastic-stack        6.0                 561MB
blacktop/elastic-stack        5.6                 543MB
blacktop/elastic-stack        5.5                 537MB
blacktop/elastic-stack        5.4                 539MB
blacktop/elastic-stack        5.3                 538MB
blacktop/elastic-stack        geoip               558MB
blacktop/elastic-stack        5.2                 537MB
blacktop/elastic-stack        4.6                 450.9MB
blacktop/elastic-stack        3.1                 363.3MB

NOTE: tag geoip is the same as tag latest, but includes the ingest-geoip and the ingest-user-agent plugins.

Getting Started

$ docker run -d --name elstack -p 80:80 -p 9200:9200 blacktop/elastic-stack

Now Navigate To

• With Docker for Mac : http://localhost
• With docker-machine : http://$(docker-machine ip)
• With docker-engine : $(docker inspect -f '{{ .NetworkSettings.IPAddress }}' elstack)

You can also use each part of the stack independently

• blacktop/elasticsearch
• blacktop/logstash
• blacktop/kibana

Documentation

• Add some demo data
• Enable SSL
• Change nginx password
• Build a multi-node Elastic Stack cluster

Known Issues ⚠️

I have noticed when running the new 5.0 version on a linux host you need to increase the memory map areas with the following command

echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
sudo sysctl -w vm.max_map_count=262144

Issues

Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to file an issue

Credits

Heavily (if not entirely) influenced by all the elastic official docker images

Todo

• Install/Run Elastic Stack
• Start Daemon and watch folder with supervisord
• Expose Logstash config folder as well as Nginx sites folder as Volumes
• Build ES test data docker image
• Add Nginx entrypoint to pass USER/PASS in as env vars
• Add SSL (auto-create certs if not found)
• Add back a 3.0 version of the stack (elk stack)
• Integrate with Bro-IDS

License

MIT Copyright (c) 2014-2018 blacktop