docker-compose.yml

version: '2'

services:

# filebeat: collect flat log files: docker run -d --name filebeat -v $PWD/filebeat/filebeat.yml:/filebeat.yml:ro -v /var/log/auth.log:/mnt/var/log/auth.log:ro sbex/filebeat

  elasticsearch:
    image: elasticsearch:5
    volumes:
     - elasticsearch:/usr/share/elasticsearch/data
     - backup:/mount/backup
     #- $PWD/es/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
    #  ES_HEAP_SIZE: 2g
      ES_JAVA_OPTS: "-Xms1g -Xmx1g"
    restart: always
    #logging:
    #  driver: syslog
    #  options:
    #    syslog-address: "udp://localhost:5000"
    #    syslog-format: rfc3164
    #    tag: elasticsearch
    networks:
      - docker_elk

  kibana:
    image: kibana:5
    links:
      - elasticsearch
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_URL=http://elasticsearch:9200
    #volumes:
    #  - $PWD/kibana/kibana.yml:/opt/kibana/config/kibana.yml
    restart: always
    depends_on:
      - elasticsearch
    #logging:
    #  driver: syslog
    #  options:
    #    syslog-address: "udp://localhost:5000"
    #    syslog-format: rfc3164
    #    tag: kibana
    networks:
      - docker_elk

  logstash:
    image: logstash:2   # v5 is very slow and unusable...
    ports:
      #- "5000:5000"
      - "5000:5000/udp"
      - "5001:5001"
    volumes:
      - $PWD/logstash/logstash.conf:/opt/logstash/conf.d/logstash.conf:ro
      - $PWD/logstash/patterns:/opt/logstash/conf.d/patterns:ro
    links:
      - elasticsearch
    command: -f /opt/logstash/conf.d/logstash.conf
    restart: always
    depends_on:
      - elasticsearch
    #logging:
    #  driver: syslog
    #  options:
    #    syslog-address: "udp://127.0.0.1:5000"
    #    syslog-format: rfc3164
    #    tag: logstash
    networks:
      - docker_elk

  proxyelk:
    image: nginx
    links:
      - kibana
    ports:
      - "5600:5600"
    volumes:
      - $PWD/proxy:/etc/nginx/conf.d
    depends_on:
      - kibana
    restart: always
    networks:
      - docker_elk

volumes:
  elasticsearch:
  backup:

networks:
  docker_elk:
    driver: bridge