docker-compose.yml

version: '3.7'

services:

  # The 'setup' service runs a one-off script which initializes the
  # 'logstash_internal' and 'kibana_system' users inside Elasticsearch with the
  # values of the passwords defined in the '.env' file.
  #
  # This task is only performed during the *initial* startup of the stack. On all
  # subsequent runs, the service simply returns immediately, without performing
  # any modification to existing users.
  setup:
    build:
      context: setup/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    init: true
    volumes:
      - setup:/state:Z
    environment:
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:-}
      LOGSTASH_INTERNAL_PASSWORD: ${LOGSTASH_INTERNAL_PASSWORD:-}
      KIBANA_SYSTEM_PASSWORD: ${KIBANA_SYSTEM_PASSWORD:-}
    networks:
      - elk

  elasticsearch:
    build:
      context: elasticsearch/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    volumes:
      - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro,z
      - elasticsearch:/usr/share/elasticsearch/data:z
    # ports:
    #   - "9200:9200"
    #   - "9300:9300"
    environment:
      ES_JAVA_OPTS: -Xmx1024m -Xms1024m
      # Bootstrap password.
      # Used to initialize the keystore during the initial startup of
      # Elasticsearch. Ignored on subsequent runs.
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:-}
      # Use single node discovery in order to disable production mode and avoid bootstrap checks.
      # see: https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
      discovery.type: single-node
      node.max_local_storage_nodes: '3'
    networks:
      - elk
    restart: always
    deploy:
        mode: replicated
        replicas: ${ES_REPLICAS}
        resources:
          limits:
            memory: ${MEM_LIMIT}
        update_config:
            parallelism: 1
            delay: 10s
            order: stop-first
            failure_action: rollback
        restart_policy:
            condition: on-failure
            delay: 5s
            max_attempts: 5
            window: 30s
        placement:
            constraints: [node.labels.es_node == 1]
            max_replicas_per_node: 3  

  logstash:
    build:
      context: logstash/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    volumes:
      - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro,Z
      - ./logstash/pipeline:/usr/share/logstash/pipeline:ro,Z
    ports:
      - "5044:5044"
      - "5000:5000/tcp"
      - "5000:5000/udp"
      - "9600:9600"
    environment:
      LS_JAVA_OPTS: -Xmx256m -Xms256m
      LOGSTASH_INTERNAL_PASSWORD: ${LOGSTASH_INTERNAL_PASSWORD:-}
    networks:
      - elk
    depends_on:
      - elasticsearch
    restart: always
    deploy:
        mode: replicated
        replicas: 1
        resources:
          limits:
            memory: ${MEM_LIMIT}
        update_config:
            parallelism: 1
            delay: 10s
            order: stop-first
            failure_action: rollback
        restart_policy:
            condition: on-failure
            delay: 5s
            max_attempts: 5
            window: 30s
        placement:
            constraints: [node.labels.es_master == 1]
            max_replicas_per_node: 1        

  kibana:
    build:
      context: kibana/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    volumes:
      - ./kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml:ro,Z
    ports:
      - "5601:5601"
    environment:
      KIBANA_SYSTEM_PASSWORD: ${KIBANA_SYSTEM_PASSWORD:-}
    networks:
      - elk
    depends_on:
      - elasticsearch
    restart: always
    deploy:
        mode: replicated
        replicas: 1
        resources:
          limits:
            memory: ${MEM_LIMIT}
        update_config:
            parallelism: 1
            delay: 10s
            order: stop-first
            failure_action: rollback
        restart_policy:
            condition: on-failure
            delay: 5s
            max_attempts: 5
            window: 30s
        placement:
            constraints: [node.labels.es_master == 1]
            max_replicas_per_node: 1         

networks:
  elk:
    driver: overlay

volumes:
  setup:
  elasticsearch: