beubi/elk repository overview

⁠ELK stack

Elasticsearch, Logstash and Kibana docker image.

This image is based on willdurand/elk and contains head elasticsearch head plugin and logstash beats plugin.

⁠Versions

• Elasticsearch 1.4
• Logstash 1.5
• Kibana 4.1.2

⁠Usage

$ docker run -itd \
           -p 8080:80 -p 9200:9200 -p 5043:5043 \
           -v path/to/elasticserach/data/folder:/data \
           -v path/to/logstash/config:/etc/logstash \
           -v path/to/elasticsearch/config:/etc/elasticsearch/ \
           -v path/to/filebeats/ssl/crt:/etc/ssl/filebeats \
           beubi/elk

Then, browse: http://localhost:8080⁠ (replace localhost with your public IP address).

Your logstash configuration directory MUST contain at least one logstash configuration file. If several files are found in the configuration directory, logstash will use all of them, concatenated in lexicographical order, as the configuration.

⁠Compose Configuration

beubi:
    image: beubi/elk
    ports:
        - "8080:80"
        - "9200:9200"
        - "5043:5043"
    volumes:
        - /path/to/elasticserach/data/folder:/data
        - /path/to/elasticsearch/config:/etc/elasticsearch
        - /path/to/your/logstash/config:/etc/logstash
        - path/to/filebeats/ssl/crt:/etc/ssl/filebeats

⁠Notes

Elasticsearch data are located in the /data folder. If you want to store it for later use you should mount a local folder as a volume to preserv it.

You can also mount volume for elastic search configuration to override the default elasticsearch configurations. Elastic search configs are located in the forder /etc/elasticsearch in yml files format-

At least one logstash configuration file must be mounted in the folder /etc/logstash, other wise logstash will crash.

If you intend to use logstash beats plugin you need to mount a volume for your ssl certificates, we sugest that you do that in the /etc/ssl/filebeats folder (althou this will be dependent from your logtash configuration).