[{"_1":2,"_154":-5,"_155":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_133":134},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":17},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_124":-5,"_125":11,"_126":17,"_127":11,"_128":-5,"_129":11,"_130":-5,"_131":132},"canonicalUrl","https://hub.docker.com/r/divideby0/docker-elk/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","divideby0","reponame","docker-elk","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":-5,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":17,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2015-07-30T00:55:48.98777Z","description","","is_private","last_updated","2015-08-01T04:26:01.602191Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.distribution.manifest.v1+prettyjws","name","pull_count",348,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Elasticsearch, Logstash, Kibana (ELK) Docker image\n\n[![](https://badge.imagelayers.io/sebp/elk:latest.svg)](https://imagelayers.io/?images=sebp/elk:latest 'Get your own badge on imagelayers.io')\n\nThis Docker image provides a convenient centralised log server and log management web interface, by packaging [Elasticsearch](http://www.elasticsearch.org/) (version 1.7.0), [Logstash](http://logstash.net/) (version 1.5.2), and [Kibana](http://www.elasticsearch.org/overview/kibana/) (version 4.1.1), collectively known as ELK.\n\n### Contents ###\n\n- [Installation](#installation)\n- [Usage](#usage)\n\t- [Running the container using Docker Compose](#running-with-docker-compose)\n\t- [Creating a dummy log entry](#creating-dummy-log-entry)\n- [Forwarding logs](#forwarding-logs)\n\t- [Linking a Docker container to the ELK container](#linking-containers)\n- [Building the image](#building-image)\n- [Extending the image](#extending-image)\n\t- [Installing Elasticsearch plugins](#installing-elasticsearch-plugins)\n\t- [Installing Logstash plugins](#installing-logstash-plugins)\n- [Storing log data](#storing-log-data)\n- [Security considerations](#security-considerations)\n- [References](#references)\n- [About](#about)\n\n## Installation \n\nInstall [Docker](https://docker.com/), either using a native package (Linux) or wrapped in a virtual machine (Windows, OS X – e.g. using [Boot2Docker](http://boot2docker.io/) or [Vagrant](https://www.vagrantup.com/)).\n\nTo pull this image from the [Docker registry](https://registry.hub.docker.com/u/sebp/elk/), open a shell prompt and enter:\n\n\t$ sudo docker pull sebp/elk\n\n**Note** – This image has been built automatically from the source files in the [source Git repository on GitHub](https://github.com/spujadas/elk-docker). If you want to build the image yourself, see the *[Building the image](#building-image)* section below.\n\n## Usage \n\nRun the container from the image with the following command:\n\n\t$ sudo docker run -p 5601:5601 -p 9200:9200 -p 5000:5000 -p 3333:3333 -it --name elk sebp/elk\n\nThis command publishes the following ports, which are needed for proper operation of the ELK stack:\n\n- 5601 (Kibana web interface).\n- 9200 (Elasticsearch JSON interface).\n- 5000 (Logstash server, receives logs from Logstash forwarders – see the *[Forwarding logs](#forwarding-logs)* section below).\n- 5000 (Logstash TCP, receives logs from Logstash TCP clients).\n\n**Note** – The image also exposes Elasticsearch's transport interface on port 9300. Use the `-p 5300:5300` option with the `docker` command above to publish it.\n\nThe figure below shows how the pieces fit together.\n\n\t- +------------------------------------------------+\n\t | ELK server (Docker image) |\n\t+----------------------+ | |\n\t| | +-----> port 5601 - Kibana web interface |\n\t| Admin workstation +----+ | |\n\t| | +-----> port 9200 - Elasticsearch JSON interface |\n\t+----------------------+ | |\n\t | port 9300 - Elasticsearch transport interface |\n\t+----------------------+ | |\n\t| Server | | |\n\t| +------------------+ | | |\n\t| |logstash forwarder+------------> port 5000 - Logstash server |\n\t| +------------------+ | | |\n\t+----------------------+ +------------------------------------------------+\n\nAccess Kibana's web interface by browsing to `http://:5601`, where `` is the hostname or IP address of the host Docker is running on (see note), e.g. `localhost` if running a local native version of Docker, or the IP address of the virtual machine if running a VM-hosted version of Docker (see note).\n\n**Note** – To configure and/or find out the IP address of a VM-hosted Docker installation, see [https://docs.docker.com/installation/windows/](https://docs.docker.com/installation/windows/) (Windows) and [https://docs.docker.com/installation/mac/](https://docs.docker.com/installation/mac/) (OS X) for guidance if using Boot2Docker. If you're using [Vagrant](https://www.vagrantup.com/), you'll need to set up port forwarding (see [https://docs.vagrantup.com/v2/networking/forwarded_ports.html](https://docs.vagrantup.com/v2/networking/forwarded_ports.html).\n\nYou can stop the container with `^C`, and start it again with `sudo docker start elk`.\n\nAs from Kibana version 4.0.0, you won't be able to see anything (not even an empty dashboard) until something has been logged (see the *[Creating a dummy log entry](#creating-dummy-log-entry)* sub-section below on how to test your set-up, and the *[Forwarding logs](#forwarding-logs)* section on how to forward logs from regular applications).\n\n### Running the container using Docker Compose \n\nIf you're using [Docker Compose](https://docs.docker.com/compose/) (formerly known as [Fig](http://fig.sh)) to manage your Docker services (and if not you really should as it will make your life much easier!), then you can create an entry for the ELK Docker image by adding the following lines to your `docker-compose.yml` file:\n\n\telk:\n\t image: sebp/elk\n\t ports:\n\t - \"5601:5601\"\n\t - \"9200:9200\"\n\t - \"5000:5000\"\n\t - \"3333:3333\"\n\nYou can then start the ELK container like this:\n\n\t$ sudo docker-compose up elk\n\n### Creating a dummy log entry \n\nIf you haven't got any logs yet and want to manually create a dummy log entry for test purposes (for instance to see the dashboard), first start the container as usual (`sudo docker run ...` or `docker-compose up ...`).\n\nIn another terminal window, find out the name of the container running ELK, which is displayed in the last column of the output of the `sudo docker ps` command.\n\n\t$ sudo docker ps\n\tCONTAINER ID IMAGE ... NAMES\n\t86aea21cab85 elkdocker_elk:latest ... elkdocker_elk_1\n\nOpen a shell prompt in the container and type (replacing `` with the name of the container, e.g. `elkdocker_elk_1` in the example above):\n\n\t$ sudo docker exec -it /bin/bash\n\n**Note** - If you're running a pre-1.4 version of Docker (before the `exec` command was introduced) then:\n\n- Run the container interactively:\n\n\t- With the regular `docker` command use `sudo docker run -p 5601:5601 -p 9200:9200 -p 5000:5000 -p 3333:3333 -it --name elk sebp/elk /bin/bash` – note the extra `/bin/bash` at the end compared to the usual command line\n\t- With Compose use `sudo docker-compose run --service-ports elk /bin/bash`.\n\n- At the container's shell prompt, type `start.sh&` to start Elasticsearch, Logstash and Kibana in the background, and wait for everything to be up and running (wait for `{\"@timestamp\": ... , \"message\": \"Listening on 0.0.0.0:5601\", ... }`)\n\nAt the prompt, enter:\n\n\t# /opt/logstash/bin/logstash -e 'input { stdin { } } output { elasticsearch { host => localhost } }'\n\nWait for Logstash to start (as indicated by the message `Logstash startup completed`), then type some dummy text followed by Enter to create a log entry:\n\n\tthis is a dummy entry\n\n**Note** - You can create as many entries as you want. Use `^C` to go back to the bash prompt.\n\nIf you browse to `http://:9200/_search?pretty` (e.g. [http://localhost:9200/_search?pretty](http://localhost:9200/_search?pretty) for a local native instance of Docker) you'll see that Elasticsearch has indexed the entry:\n\n\t{\n\t ...\n\t \"hits\": {\n\t ...\n\t \"hits\": [ {\n\t \"_index\": \"logstash-...\",\n\t \"_type\": \"logs\",\n\t ...\n\t \"_source\": { \"message\": \"this is a dummy entry\", \"@version\": \"1\", \"@timestamp\": ... }\n\t } ]\n\t }\n\t}\n\nYou can now browse to Kibana's web interface at `http://:5601` (e.g. [http://localhost:5601](http://localhost:5601) for a local native instance of Docker).\n\nMake sure that the drop-down \"Time-field name\" field is pre-populated with the value `@timestamp`, then click on \"Create\", and you're good to go.\n\n## Forwarding logs \n\nForwarding logs from a host relies on a Logstash forwarder agent that collects logs (e.g. from log files, from the syslog daemon) and sends them to our instance of Logstash.\n\nInstall [Logstash forwarder](https://github.com/elasticsearch/logstash-forwarder) on the host you want to collect and forward logs from (see the *[References](#references)* section below for links to detailed instructions).\n\nHere is a sample configuration file for Logstash forwarder, that forwards syslog and authentication logs, as well as [nginx](http://nginx.org/) logs.\n\n\t{\n\t \"network\": {\n\t \"servers\": [ \"elk:5000\" ],\n\t \"timeout\": 15,\n\t \"ssl ca\": \"/etc/pki/tls/certs/logstash-forwarder.crt\"\n\t },\n\t \"files\": [\n\t {\n\t \"paths\": [\n\t \"/var/log/syslog\",\n\t \"/var/log/auth.log\"\n\t ],\n\t \"fields\": { \"type\": \"syslog\" }\n\t },\n\t {\n\t \"paths\": [\n\t \"/var/log/nginx/access.log\"\n\t ],\n\t \"fields\": { \"type\": \"nginx-access\" }\n\t }\n\t ]\n\t}\n\nBy default (see `/etc/init.d/logstash-forwarder` if you need to tweak anything):\n\n- The Logstash forwarder configuration file must be located in `/etc/logstash-forwarder`.\n- The Logstash forwarder needs a syslog daemon (e.g. rsyslogd, syslog-ng) to be running.\n\nIn the sample configuration file, make sure that you:\n\n- Replace `elk` in `elk:5000` with the hostname or IP address of the ELK-serving host.\n- Copy the `logstash-forwarder.crt` file (which contains the Logstash server's certificate) from the ELK image to `/etc/pki/tls/certs/logstash-forwarder.crt`.\n\n**Note** – The ELK image includes configuration items (`/etc/logstash/conf.d/11-nginx.conf` and `/opt/logstash/patterns/nginx`) to parse nginx access logs, as forwarded by the Logstash forwarder instance above.\n\n### Linking a Docker container to the ELK container \n\nIf you want to forward logs from a Docker container to the ELK container, then you need to link the two containers.\n\n**Note** – The log-emitting Docker container must have a Logstash forwarder agent running in it for this to work.\n\nFirst of all, give the ELK container a name (e.g. `elk`) using the `--name` option:\n\n\t$ sudo docker run -p 5601:5601 -p 9200:9200 -p 5000:5000 -it --name elk sebp/elk\n\nThen start the log-emitting container with the `--link` option (replacing `your/image` with the name of the Logstash-forwarder-enabled image you're forwarding logs from):\n\n\t$ sudo docker run -p 80:80 -it --link elk:elk your/image\n\nFrom the perspective of the log emitting container, the ELK container is now known as `elk`, which is the hostname to be used in the `logstash-forwarder` configuration file.\n\nWith Compose here's what example entries for a (locally built log-generating) container and an ELK container might look like in the `docker-compose.yml` file.\n\n\tyourapp:\n\t image: your/image\n\t ports:\n\t - \"80:80\"\n\t links:\n\t - elk\n\n\telk:\n\t image: sebp/elk\n\t ports:\n\t - \"5601:5601\"\n\t - \"9200:9200\"\n\t - \"5000:5000\"\n\n## Building the image \n\nTo build the Docker image from the source files, first clone the [Git repository](https://github.com/spujadas/elk-docker), go to the root of the cloned directory (i.e. the directory that contains `Dockerfile`), and:\n\n- If you're using the vanilla `docker` command then run `sudo docker build -t .`, where `` is the repository name to be applied to the image, which you can then use to run the image with the `docker run` command.\n\n- If you're using Compose then run `sudo docker-compose build elk`, which uses the `docker-compose.yml` file from the source repository to build the image. You can then run the built image with `sudo docker-compose up`.\n\n\n## Extending the image \n\nTo extend the image, you can either fork the source Git repository and hack away, or – more in the spirit of the Docker philosophy – use the image as a base image and build on it, adding files (e.g. configuration files to process logs sent by log-producing applications, plugins for Elasticsearch) and overwriting files (e.g. configuration files, certificate and private key files) as required.\n\nTo create a new image based on this base image, you want your `Dockerfile` to include:\n\n\tFROM sebp/elk\n\nfollowed by instructions to extend the image (see Docker's [Dockerfile Reference page](https://docs.docker.com/reference/builder/) for more information).\n\nThe next few subsections present some typical use cases.\n\n### Installing Elasticsearch plugins \n\nElasticsearch's home directory in the image is `/usr/share/elasticsearch`, its [plugin management script](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-plugins.html) (`plugin`) resides in the `bin` subdirectory, and plugins are installed in `plugins`.\n\nA `Dockerfile` like the following will extend the base image and install Elastic HQ, a management and monitoring plugin for Elasticsearch, using `plugin`.\n\n\tFROM sebp/elk\n\n\tENV ES_HOME /usr/share/elasticsearch\n\tWORKDIR ${ES_HOME}\n\n\tRUN bin/plugin -i royrusso/elasticsearch-HQ\n\nYou can now build the new image (see the *[Building the image](#building-image)* section above) and run the container in the same way as you did with the base image. The Elastic HQ interface will be accessible at `http://:9200/_plugin/HQ/` (e.g. [http://localhost:9200/_plugin/HQ/](http://localhost:9200/_plugin/HQ/) for a local native instance of Docker).\n\n### Installing Logstash plugins \n\nThe name of Logstash's home directory in the image is stored in the `LOGSTASH_HOME` environment variable (which is set to `/opt/logstash` in the base image). Logstash's plugin management script (`plugin`) is located in the `bin` subdirectory.\n\nThe following `Dockerfile` can be used to extend the base image and install the [RSS input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-rss.html):\n\n\tFROM sebp/elk\n\n\tWORKDIR ${LOGSTASH_HOME}\n\tRUN bin/plugin install logstash-input-rss\n\nSee the *[Building the image](#building-image)* section above for instructions on building the new image. You can then run a container based on this image using the same command line as the one in the *[Usage](#usage)* section.\n\n## Storing log data \n\nIn order to keep log data across container restarts, this image mounts `/var/lib/elasticsearch` — which is the directory that Elasticsearch stores its data in — as a volume.\n\nYou may however want to use a dedicated data volume to store this log data, for instance to facilitate back-up and restore operations.\n\nOne way to do this with the `docker` command-line tool is to first create a named container called `elk_data` with a bound Docker volume by using the `-v` option:\n\n\t$ sudo docker run -p 5601:5601 -p 9200:9200 -5000:5000 -p 3333:3333 -v /var/lib/elasticsearch --name elk_data sebp/elk\n\nYou can now reuse the persistent volume from that container using the `--volumes-from` option:\n\n\t$ sudo docker run -p 5601:5601 -p 9200:9200 -p 5000:5000 -p 3333:3333 --volumes-from elk_data --name elk sebp/elk\n\n**Note** – By design, Docker never deletes a volume automatically (e.g. when no longer used by any container). Whilst this avoids accidental data loss, it also means that things can become messy if you're not managing your volumes properly (i.e. using the `-v` option when removing containers with `docker rm` to also delete the volumes... bearing in mind that the actual volume won't be deleted as long as at least one container is still referencing it, even if it's not running). As of this writing, managing Docker volumes can be a bit of a headache, so you might want to have a look at [docker-cleanup-volumes](https://github.com/chadoe/docker-cleanup-volumes), a shell script that deletes unused Docker volumes.\n\nSee Docker's page on [Managing Data in Containers](https://docs.docker.com/userguide/dockervolumes/) and Container42's [Docker In-depth: Volumes](http://container42.com/2014/11/03/docker-indepth-volumes/) page for more information on managing data volumes.\n\n## Security considerations \n\nAs it stands this image is meant for local test use, and as such hasn't been secured: access to the ELK services is not restricted, and a default authentication server certificate (`logstash-forwarder.crt`) and private key (`logstash-forwarder.key`) are bundled with the image.\n\nTo harden this image, at the very least you would want to:\n\n- Restrict the access to the ELK services to authorised hosts/networks only, as described in e.g. [Elasticsearch Scripting and Security](http://www.elasticsearch.org/blog/scripting-security/) and [Elastic Security: Deploying Logstash, ElasticSearch, Kibana \"securely\" on the Internet](http://blog.eslimasec.com/2014/05/elastic-security-deploying-logstash.html).\n- Password-protect the access to Kibana and Elasticsearch (see [SSL And Password Protection for Kibana](http://technosophos.com/2014/03/19/ssl-password-protection-for-kibana.html)).\n- Generate a new self-signed authentication certificate for the Logstash server (`cd /etc/pki/tls; sudo openssl req -x509 -batch -nodes -days 3650 -newkey rsa:2048 -keyout private/logstash-forwarder.key -out certs/logstash-forwarder.crt` for a 10-year certificate) or (better) get a proper certificate from a commercial provider (known as a certificate authority), and keep the private key private.\n\n## References \n\n- [How To Install Elasticsearch, Logstash, and Kibana 4 on Ubuntu 14.04](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-4-on-ubuntu-14-04)\n- [The Docker Book](http://www.dockerbook.com/)\n- [The Logstash Book](http://www.logstashbook.com/)\n- [Elastic's reference documentation](https://www.elastic.co/guide/index.html)\n\n## About \n\nWritten by [Sébastien Pujadas](http://pujadas.net), released under the [Apache 2 license](http://www.apache.org/licenses/LICENSE-2.0).\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",1692205877,"orgData","recentTags",[87],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":98,"_46":113,"_114":90,"_115":29,"_116":52,"_53":117,"_118":119,"_120":104,"_121":113,"_122":62,"_123":17},"content_type","creator",184692,"digest","sha256:8a14d61ef25d67874075f6935d139c0c424157e0381fd7df7a3b15d35902b28c","full_size",393572553,"id",651180,"images",[99],{"_100":101,"_91":92,"_102":44,"_103":104,"_105":106,"_107":44,"_108":44,"_109":-5,"_110":111,"_59":62,"_112":-5},"architecture","amd64","features","last_pulled","2026-09-22T04:25:34.515153382Z","last_pushed","2015-09-25T00:30:06Z","os","os_features","os_version","size",393572969,"variant","2015-10-13T05:54:18Z","last_updater","last_updater_username","media_type","latest","repository",270270,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":135,"_142":143,"_131":152,"_153":11},{"_36":136,"_38":137,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":138,"_53":31,"_28":29,"_54":55,"_56":-5,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":139,"_75":17,"_76":141,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":140},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_144":60,"_145":-5,"_146":-5,"_147":148},"count","next","previous","results",[149],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":150,"_46":113,"_114":90,"_115":29,"_116":52,"_53":117,"_118":119,"_120":104,"_121":113,"_122":62,"_123":17},[151],{"_100":101,"_91":92,"_102":44,"_103":104,"_105":106,"_107":44,"_108":44,"_109":-5,"_110":111,"_59":62,"_112":-5},[],"canDeleteTags","actionData","errors"]

divideby0/docker-elk

Tags for divideby0/docker-elk