docker-compose.yml

---
version: '3.6'
services:
  # The environment variable "TAG" is used throughout this file to
  # specify the version of the images to run. The default is set in the
  # '.env' file in this folder. It can be overridden with any normal
  # technique for setting environment variables, for example:
  #
  #   TAG=6.0.0-beta1 docker-compose up
  #
  # REF: https://docs.docker.com/compose/compose-file/#variable-substitution
  #
  # Also be sure to set the ELASTIC_VERSION variable. For released versions,
  # ${TAG} and ${ELASTIC_VERSION} will be identical, but for pre-release
  # versions, ${TAG} might contain an extra build identifier, like
  # "6.0.0-beta1-3eab5b40", so a full invocation might look like:
  #
  #   ELASTIC_VERSION=6.0.0-beta1 TAG=6.0.0-beta1-3eab5b40 docker-compose up
  #
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:${TAG}
    container_name: elasticsearch
    # secrets:
    #   - source: ca.crt
    #     target: /usr/share/elasticsearch/config/certs/ca/ca.crt
    #   - source: elasticsearch.yml
    #     target: /usr/share/elasticsearch/config/elasticsearch.yml
    #   - source: elasticsearch.keystore
    #     target: /usr/share/elasticsearch/config/elasticsearch.keystore
    #   - source: elasticsearch.key
    #     target: /usr/share/elasticsearch/config/certs/elasticsearch/elasticsearch.key
    #   - source: elasticsearch.crt
    #     target: /usr/share/elasticsearch/config/certs/elasticsearch/elasticsearch.crt
    ports: ['9200:9200']
    networks: ['stack']
    # volumes:
    #   - 'es_data:/usr/share/elasticsearch/data'
    #   - './scripts/setup-users.sh:/usr/local/bin/setup-users.sh:ro'
    # healthcheck:
    #   test: curl --cacert /usr/share/elasticsearch/config/certs/ca/ca.crt -s https://localhost:9200 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
    #   interval: 30s
    #   timeout: 10s
    #   retries: 5

  kibana:
    image: docker.elastic.co/kibana/kibana:${TAG}
    container_name: kibana
    # secrets:
    #   - source: kibana.yml
    #     target: /usr/share/kibana/config/kibana.yml
    #   - source: kibana.keystore
    #     target: /usr/share/kibana/data/kibana.keystore
    #   - source: ca.crt
    #     target: /usr/share/kibana/config/certs/ca/ca.crt
    #   - source: kibana.key
    #     target: /usr/share/kibana/config/certs/kibana/kibana.key
    #   - source: kibana.crt
    #     target: /usr/share/kibana/config/certs/kibana/kibana.crt
    ports: ['5601:5601']
    networks: ['stack']
    depends_on: ['elasticsearch']
    # healthcheck:
    #   test: curl --cacert /usr/share/elasticsearch/config/certs/ca/ca.crt -s https://localhost:5601 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
    #   interval: 30s
    #   timeout: 10s
    #   retries: 5

  # logstash:
  #   image: docker.elastic.co/logstash/logstash:${TAG}
  #   container_name: logstash
  #   secrets:
  #     - source: logstash.conf
  #       target: /usr/share/logstash/pipeline/logstash.conf
  #     - source: logstash.yml
  #       target: /usr/share/logstash/config/logstash.yml
  #     - source: logstash.keystore
  #       target: /usr/share/logstash/config/logstash.keystore
  #     - source: ca.crt
  #       target: /usr/share/logstash/config/certs/ca/ca.crt
  #   networks: ['stack']
  #   depends_on: ['elasticsearch']
  #   healthcheck:
  #     test: bin/logstash -t
  #     interval: 60s
  #     timeout: 50s
  #     retries: 5

  # auditbeat:
  #   image: docker.elastic.co/beats/auditbeat:${TAG}
  #   container_name: auditbeat
  #   command: -e --strict.perms=false # -e flag to log to stderr and disable syslog/file output
  #   cap_add: ['AUDIT_CONTROL', 'AUDIT_READ']
  #   secrets:
  #     - source: auditbeat.yml
  #       target: /usr/share/auditbeat/auditbeat.yml
  #     - source: auditbeat.keystore
  #       target: /usr/share/auditbeat/auditbeat.keystore
  #     - source: ca.crt
  #       target: /usr/share/auditbeat/certs/ca/ca.crt
  #   # Auditbeat must run in the main process namespace.
  #   pid: host
  #   volumes:
  #     - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
  #   networks: ['stack']
  #   depends_on: ['elasticsearch', 'kibana']
  #   healthcheck:
  #     test: auditbeat --strict.perms=false test config
  #     interval: 30s
  #     timeout: 15s
  #     retries: 5
  #
  # filebeat:
  #   image: docker.elastic.co/beats/filebeat:${TAG}
  #   container_name: filebeat
  #   command: --strict.perms=false -e  # -e flag to log to stderr and disable syslog/file output
  #   # If the host system has logs at "/var/log", mount them at "/mnt/log"
  #   # inside the container, where Filebeat can find them.
  #   # volumes: ['/var/log:/mnt/log:ro']
  #   secrets:
  #     - source: filebeat.yml
  #       target: /usr/share/filebeat/filebeat.yml
  #     - source: filebeat.keystore
  #       target: /usr/share/filebeat/filebeat.keystore
  #     - source: ca.crt
  #       target: /usr/share/filebeat/certs/ca/ca.crt
  #   volumes:
  #     - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
  #   networks: ['stack']
  #   depends_on: ['elasticsearch', 'kibana']
  #   healthcheck:
  #     test: filebeat test config
  #     interval: 30s
  #     timeout: 15s
  #     retries: 5
  #
  # heartbeat:
  #   image: docker.elastic.co/beats/heartbeat:${TAG}
  #   container_name: heartbeat
  #   command: --strict.perms=false -e  # -e flag to log to stderr and disable syslog/file output
  #   secrets:
  #     - source: heartbeat.yml
  #       target: /usr/share/heartbeat/heartbeat.yml
  #     - source: heartbeat.keystore
  #       target: /usr/share/heartbeat/heartbeat.keystore
  #     - source: ca.crt
  #       target: /usr/share/heartbeat/certs/ca/ca.crt
  #   volumes:
  #     - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
  #   networks: ['stack']
  #   depends_on: ['elasticsearch', 'kibana']
  #   healthcheck:
  #     test: heartbeat test config
  #     interval: 30s
  #     timeout: 15s
  #     retries: 5
  #
  # metricbeat:
  #   image: docker.elastic.co/beats/metricbeat:${TAG}
  #   container_name: metricbeat
  #   # The commented sections below enable Metricbeat to monitor the Docker host,
  #   # rather than the Metricbeat container. It's problematic with Docker for
  #   # Windows, however, since "/proc", "/sys" etc. don't exist on Windows.
  #   # The same likely applies to OSX (needs testing).
  #   # volumes:
  #   #   - /proc:/hostfs/proc:ro
  #   #   - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
  #   #   - /:/hostfs:ro
  #   command: --strict.perms=false -e  # -e flag to log to stderr and disable syslog/file output
  #   secrets:
  #     - source: metricbeat.yml
  #       target: /usr/share/metricbeat/metricbeat.yml
  #     - source: metricbeat.keystore
  #       target: /usr/share/metricbeat/metricbeat.keystore
  #     - source: ca.crt
  #       target: /usr/share/metricbeat/certs/ca/ca.crt
  #   volumes:
  #     - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
  #   networks: ['stack']
  #   depends_on: ['elasticsearch', 'kibana']
  #   healthcheck:
  #     test: metricbeat test config
  #     interval: 30s
  #     timeout: 15s
  #     retries: 5
  #
  # packetbeat:
  #   image: docker.elastic.co/beats/packetbeat:${TAG}
  #   container_name: packetbeat
  #   # Packetbeat needs some elevated privileges to capture network traffic.
  #   # We'll grant them with POSIX capabilities.
  #   cap_add: ['NET_RAW', 'NET_ADMIN']
  #   # Use "host mode" networking to allow Packetbeat to capture traffic from
  #   # the real network interface on the host, rather than being isolated to the
  #   # container's virtual interface.
  #   network_mode: host
  #   # Since we did that, Packetbeat is not part of the "stack" Docker network
  #   # that the other containers are connected to, and thus can't resolve the
  #   # hostname "elasticsearch". Instead, we'll tell it to find Elasticsearch
  #   # on "localhost", which is the Docker host machine in this context.
  #   command: -e -E 'output.elasticsearch.hosts=["localhost:9200"]'
  #   depends_on: ['elasticsearch']
  #   command: --strict.perms=false -e -E output.elasticsearch.hosts="https://localhost:9200" # -e flag to log to stderr and disable syslog/file output
  #   secrets:
  #     - source: packetbeat.yml
  #       target: /usr/share/packetbeat/packetbeat.yml
  #     - source: packetbeat.keystore
  #       target: /usr/share/packetbeat/packetbeat.keystore
  #     - source: ca.crt
  #       target: /usr/share/packetbeat/certs/ca/ca.crt
  #   volumes:
  #     - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
  #   depends_on: ['elasticsearch', 'kibana']
  #   healthcheck:
  #     test: packetbeat test config
  #     interval: 30s
  #     timeout: 15s
  #     retries: 5

  apm-server:
    image: docker.elastic.co/apm/apm-server:${TAG}
    container_name: apm_server
    ports: ['8200:8200']
    networks: ['stack']
    command: --strict.perms=false -e  # -e flag to log to stderr and disable syslog/file output
    # secrets:
    #   - source: apm-server.yml
    #     target: /usr/share/apm-server/apm-server.yml
    #   - source: apm-server.keystore
    #     target: /usr/share/apm-server/apm-server.keystore
    #   - source: ca.crt
    #     target: /usr/share/apm-server/certs/ca/ca.crt
    # volumes:
    #   - './scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro'
    depends_on: ['elasticsearch', 'kibana']
    # healthcheck:
    #   test: curl --cacert /usr/share/elasticsearch/config/certs/ca/ca.crt -s https://localhost:8200/healthcheck >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
    #   interval: 30s
    #   timeout: 10s
    #   retries: 5

networks: {stack: {}}
# use docker volume to persist ES data outside of a container.
volumes:
  es_data:

# secrets:
#   ca.crt:
#     file: ./config/ssl/ca/ca.crt
#   logstash.yml:
#     file: ./config/logstash/logstash.yml
#   logstash.keystore:
#     file: ./config/logstash/logstash.keystore
#   logstash.conf:
#     file: ./config/logstash/pipeline/logstash.conf
#   elasticsearch.yml:
#     file: ./config/elasticsearch/elasticsearch.yml
#   elasticsearch.keystore:
#     file: ./config/elasticsearch/elasticsearch.keystore
#   elasticsearch.key:
#     file: ./config/elasticsearch/elasticsearch.key
#   elasticsearch.crt:
#     file: ./config/elasticsearch/elasticsearch.crt
#   elasticsearch.p12:
#     file: ./config/elasticsearch/elasticsearch.p12
#   kibana.yml:
#     file: ./config/kibana/kibana.yml
#   kibana.keystore:
#     file: ./config/kibana/kibana.keystore
#   kibana.key:
#     file: ./config/kibana/kibana.key
#   kibana.crt:
#     file: ./config/kibana/kibana.crt
#   auditbeat.yml:
#     file: ./config/auditbeat/auditbeat.yml
#   auditbeat.keystore:
#     file: ./config/auditbeat/auditbeat.keystore
#   filebeat.yml:
#     file: ./config/filebeat/filebeat.yml
#   filebeat.keystore:
#     file: ./config/filebeat/filebeat.keystore
#   heartbeat.yml:
#     file: ./config/heartbeat/heartbeat.yml
#   heartbeat.keystore:
#     file: ./config/heartbeat/heartbeat.keystore
#   metricbeat.yml:
#     file: ./config/metricbeat/metricbeat.yml
#   metricbeat.keystore:
#     file: ./config/metricbeat/metricbeat.keystore
#   packetbeat.yml:
#     file: ./config/packetbeat/packetbeat.yml
#   packetbeat.keystore:
#     file: ./config/packetbeat/packetbeat.keystore
#   apm-server.yml:
#     file: ./config/apm-server/apm-server.yml
#   apm-server.keystore:
#     file: ./config/apm-server/apm-server.keystore