docker-sof-elk/docker-compose.yaml at connor · richard-callis/docker-sof-elk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
version: '3.9'

services:

    # Used as load balancer and frontend domain parser
    traefik:
        image: traefik # The official Traefik docker image
        command: --api --docker # Enables the web UI and tells Traefik to listen to docker
        ports:
            - "80:80"     # The HTTP port
            - "443:443"     # The HTTPS port
            - "8080:8080" # The Web UI (enabled by --api)
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - ./traefik/${TRAEFIK_CONFIG:-traefik_dev.toml}:/traefik.toml
            - ./traefik/acme.json:/acme.json
        networks:
            - bridge

    # portainer:
    #     image: portainer/portainer
    #     ports:
    #         - 9000
    #     command: -H unix:///var/run/docker.sock
    #     volumes:
    #         - /var/run/docker.sock:/var/run/docker.sock
    #         - ./portainer-data:/data
    #     networks:
    #         - bridge
    #     labels:
    #         - "traefik.backend=portainer"
    #         - "traefik.docker.network=${network_name:-masternetwork}"
    #         - "traefik.frontend.rule=Host:portainer.${BASE_URL:-localhost}" # add another rule with ";Host:host"
    #         - "traefik.enable=true"
    #         - "traefik.port=9000"

    # ELK
    elasticsearch:
        image: elasticsearch:8.1.3
        volumes:
            # for persistent data
            - ./elasticsearch-data:/usr/share/elasticsearch/data
            - ./elk_config/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
            - ./sof-elk:/usr/local/sof-elk
        ports:
            - "9200:9200"
            - "9300:9300"
        environment:
            ES_JAVA_OPTS: "-Xmx256m -Xms256m"
        networks:
            - bridge

        restart: unless-stopped
    logstash:
        image: logstash:8.1.3
        volumes:
            - ./elk_config/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
            - ./sof-elk:/usr/local/sof-elk
            - ./resources/GeoIP:/usr/local/share/GeoIP
        ports:
            - "5000/udp"
            - "5044"
        networks:
            - bridge
        depends_on:
            - elasticsearch
        restart: unless-stopped
        # command: "--debug"
        command: "bash -c 'logstash-plugin install logstash-input-relp logstash-filter-tld logstash-filter-rest && /usr/local/bin/docker-entrypoint'"


    # Takes logs from each microservice and pipes into logstash
    logspout:
        image: bekt/logspout-logstash
        environment:
            ROUTE_URIS: 'logstash://logstash:5000'
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        depends_on:
            - logstash
            - elasticsearch
        restart: unless-stopped
        networks:
            - bridge

    kibana:
        image: kibana:8.1.3
        volumes:
            - ./elk_config/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml:ro
            - ./sof-elk:/usr/local/sof-elk
        ports:
            - "5601:5601"
        networks:
            - bridge
        depends_on:
            - elasticsearch
        restart: unless-stopped
        labels:
            - "traefik.backend=kibana"
            - "traefik.docker.network=${network_name:-masternetwork}"
            - "traefik.frontend.rule=Host:kibana.${BASE_URL:-localhost}" # add another rule with ";Host:host"
            - "traefik.enable=true"
            - "traefik.port=5601"

    filebeat:
        image: elastic/filebeat:8.1.3
        networks:
            - bridge
        volumes:
            - ./elk_config/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
            - ./sof-elk:/usr/local/sof-elk
            - ./filebeat-data:/use/share/filebeat/data # persistent data storage, may remove, doesn't seem to be used
            - ./server-files:/logstash # for actual file processing
        environment:
            - ELASTICSEARCH_HOST=elasticsearch
            - KIBANA_HOST=kibana
            - LOGSTASH_HOST=logstash
        restart: unless-stopped

    # https://github.com/silverwind/droppy
    # Used to drop files that can be immediately picked up by filebeat and sent to logstash
    droppy:
        image: silverwind/droppy
        ports:
            - "8989:8989"
        volumes:
            # - ./config:./config
            - ./server-files:/files
        restart: unless-stopped
        networks:
            - bridge
        labels:
            - "traefik.backend=droppy"
            - "traefik.docker.network=${network_name:-masternetwork}"
            - "traefik.frontend.rule=Host:droppy.${BASE_URL:-localhost}" # add another rule with ";Host:host"
            - "traefik.enable=true"
            - "traefik.port=8989"


networks:
    bridge: