docker-compose.elk.yaml

# docker-compose.prod 와 함께 실행 해야 합니다. # need to run with docker-compose.prod
# docker compose -f docker-compose.prod.yml -f docker-compose.logging.yml up --build

# changeme 로 설정된 임시 패스워드를 변경하여 사용하시길 바랍니다. # need to change temp password 'changeme'

version: '3.7'

services:
  elasticsearch:
    build:
      context: ./elk/elasticsearch
      args:
        ELASTIC_VERSION: 8.5.2
    volumes:
      - ./elk/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro,Z
      - elasticsearch:/usr/share/elasticsearch/data:Z
    ports:
      - 9200:9200
      - 9300:9300
    environment:
      node.name: elasticsearch
      ES_JAVA_OPTS: -Xms512m -Xmx512m
      # Bootstrap password.
      # Used to initialize the keystore during the initial startup of
      # Elasticsearch. Ignored on subsequent runs.
      ELASTIC_PASSWORD: changeme
      # Use single node discovery in order to disable production mode and avoid bootstrap checks.
      # see: https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
      discovery.type: single-node
    restart: unless-stopped

  logstash:
    build:
      context: ./elk/logstash
      args:
        ELASTIC_VERSION: 8.5.2
    volumes:
      - ./elk/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro,Z
      - ./elk/logstash/pipeline:/usr/share/logstash/pipeline:ro,Z
    ports:
      - 5044:5044
      - 50000:50000/tcp
      - 50000:50000/udp
      - 9600:9600
    environment:
      LS_JAVA_OPTS: -Xms256m -Xmx256m
      LOGSTASH_INTERNAL_PASSWORD: changeme
    depends_on:
      - elasticsearch
    restart: unless-stopped

  kibana:
    build:
      context: ./elk/kibana
      args:
        ELASTIC_VERSION: 8.5.2
    volumes:
      - ./elk/kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml:ro,Z
    ports:
      - 5601:5601
    environment:
      KIBANA_SYSTEM_PASSWORD: changeme
    depends_on:
      - elasticsearch
    restart: unless-stopped

  filebeat:
    build:
      context: ./elk/filebeat
      args:
        ELASTIC_VERSION: 8.5.2
    entrypoint: "filebeat -e -strict.perms=false"
    volumes:
      - ./elk/filebeat/config/filebeat.yml:/usr/share/filebeat/filebeat.yml
      - ./nginx/log:/var/log/nginx # nginx log path (require same option on nginx container)
    depends_on:
      - logstash
      - elasticsearch
      - kibana

volumes:
  elasticsearch: