babim/elastic-stack repository overview

⁠Elastic Stack Dockerfile

⁠Thanks blacktop

This repository contains a Dockerfile of the Elastic Stack⁠.

⁠Dependencies

• alpine:3.7⁠
• openjdk8-jre⁠
• Elasticsearch⁠
• Logstash⁠
• Kibana⁠

⁠Getting Started

$ docker run -d --name elstack -p 80:80 -p 9200:9200 babim/elastic-stack

⁠Now Navigate To

• With Docker for Mac⁠ : http://localhost
• With docker-machine⁠ : http://$(docker-machine ip)
• With docker-engine⁠ : $(docker inspect -f '{{ .NetworkSettings.IPAddress }}' elstack)

⁠Documentation

• Add some demo data⁠
• Enable SSL⁠
• Change nginx password⁠
• Build a multi-node Elastic Stack cluster⁠

⁠Known Issues :warning:

I have noticed when running the new 5.0 version on a linux host you need to increase the memory map areas with the following command

echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
sudo sysctl -w vm.max_map_count=262144

⁠Credits

Heavily (if not entirely) influenced by all the elastic official docker images

⁠Todo

• Install/Run Elastic Stack
• Start Daemon and watch folder with supervisord
• Expose Logstash config folder as well as Nginx sites folder as Volumes
• Build ES test data docker image
• Add Nginx entrypoint to pass USER/PASS in as env vars
• Add SSL (auto-create certs if not found)
• Add back a 3.0 version of the stack (elk stack)
• Integrate with Bro-IDS