docker-compose.yml

version: '3.8'


services:
  # ---------- ELK ----------
  es01:
    image: docker.elastic.co/elasticsearch/elasticsearch:${ES_VERSION}
    container_name: es01
    hostname: es01
    restart: always
    environment:
      - "ELASTIC_PASSWORD=${ES_PASSWORD}"
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - node.name=es01
    volumes:
      - ./elk/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
    ports:
      - "9200:9200"
      - "9300:9300"
    networks:
      elk:
    healthcheck:
      test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  ls01:
    image: docker.elastic.co/logstash/logstash:${ES_VERSION}
    container_name: ls01
    hostname: ls01
    restart: always
    volumes:
      - ./elk/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml
      - ./elk/logstash/config/pipelines.yml:/usr/share/logstash/config/pipelines.yml
      - ./elk/logstash/pipes:/usr/share/logstash/pipeline
    command: "logstash"
    ports:
      - "5044:5044"
      - "12201:12201"
      - "9600:9600"
    networks: [ "elk" ]
    depends_on: [ "es01" ]
    healthcheck:
      test: ["CMD-SHELL", "curl --silent --fail http://localhost:9600 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  kb01:
    image: docker.elastic.co/kibana/kibana:${ES_VERSION}
    container_name: kb01
    hostname: kb01
    restart: always
    volumes:
      - ./elk/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - es01
    healthcheck:
      test: ["CMD-SHELL", "curl --silent --fail http://localhost:5601/api/status --user ${ES_USERNAME}:${ES_PASSWORD}"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  # ---------- BEATS ----------
  fb01:
    image: docker.elastic.co/beats/filebeat:${ES_VERSION}
    container_name: fb01
    hostname: fb01
    restart: always
    environment:
      STRICT_PERMS: "false"
    volumes:
      - ./assets/logs/:/logs
      - ./beats/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml
    depends_on: [ "ls01" ]
    networks: [ "elk" ]
    healthcheck:
      test: filebeat test config
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  mb01:
    image: docker.elastic.co/beats/metricbeat:${ES_VERSION}
    container_name: mb01
    hostname: mb01
    restart: always
    environment:
      STRICT_PERMS: "false"
    volumes:
      - ./beats/metricbeat/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
      - /var/run/docker.sock:/var/run/docker.sock
    networks: [ "elk" ]
    depends_on: [ "es01", "kb01" ]
    ports: [ "5068:5068" ]
    healthcheck:
      test: metricbeat test config
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  pb01:
    image: docker.elastic.co/beats/packetbeat:${ES_VERSION}
    container_name: pb01
    hostname: pb01
    restart: always
    environment:
      STRICT_PERMS: "false"
    volumes:
      - ./beats/packetbeat/packetbeat.yml:/usr/share/packetbeat/packetbeat.yml
    cap_add: ['NET_RAW', 'NET_ADMIN']
    network_mode: host
    depends_on: [ "es01", "kb01" ]
    ports: [ "5069:5069" ]
    healthcheck:
      test: packetbeat test config
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  ab01:
    image: docker.elastic.co/beats/auditbeat:${ES_VERSION}
    container_name: ab01
    hostname: ab01
    restart: always
    command: auditbeat -e --strict.perms=false
    pid: host
    volumes:
      - ./beats/auditbeat/auditbeat.yml:/usr/share/auditbeat/auditbeat.yml
    cap_add: ['AUDIT_CONTROL', 'AUDIT_READ']
    networks: [ "elk" ]
    depends_on: [ "es01", "kb01" ]
    ports: [ "5070:5070" ]
    healthcheck:
      test: auditbeat test config
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  hb01:
    image: docker.elastic.co/beats/heartbeat:${ES_VERSION}
    container_name: hb01
    hostname: hb01
    restart: always
    environment:
      STRICT_PERMS: "false"
    volumes:
      - ./beats/heartbeat/heartbeat.yml:/usr/share/heartbeat/heartbeat.yml
    networks: [ "elk" ]
    depends_on: [ "es01", "kb01" ]
    ports: [ "5071:5071" ]
    healthcheck:
      test: heartbeat test config
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  # ---------- EXTRA ----------
  fl01:
    container_name: fl01
    restart: always
    image: mingrammer/flog:0.4.2
    volumes:
      - ./assets/logs:/logs
    command: -l -d 1 -f apache_common -t log -w -o /logs/apache.log


networks:
  elk: