docker-compose-log-analytics.yml

########################################################################
 # Copyright (c) Intel Corporation 2023
 # SPDX-License-Identifier: BSD-3-Clause
########################################################################

networks:
  elk:
    driver: bridge
  edgex-network:
    driver: bridge
services:
  # The 'setup' service runs a one-off script which initializes the
  # 'logstash_internal' and 'kibana_system' users inside Elasticsearch with the
  # values of the passwords defined in the '.env' file.
  #
  # This task is only performed during the *initial* startup of the stack. On all
  # subsequent runs, the service simply returns immediately, without performing
  # any modification to existing users.
  setup:
    image: elasticsearch:${ELASTIC_VERSION}
    init: true
    user: root
    # Override entrypooint to allow for user role creation
    # -e flag is included to prevent a warning from showing up in the logs
    entrypoint: sh /setup/entrypoint.sh -e TINI_SUBREAPER=true
    volumes:
      - setup:/state:Z
      - ./log-analytics/setup:/setup
    environment:
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:-}
      KIBANA_SYSTEM_PASSWORD: ${KIBANA_SYSTEM_PASSWORD:-}
    networks:
      - elk
      - edgex-network
    depends_on:
      - elasticsearch

  elasticsearch:
    image: elasticsearch:${ELASTIC_VERSION}
    volumes:
      - ./log-analytics/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro,z
      - elasticsearch:/usr/share/elasticsearch/data:z
    ports:
      - 9200:9200/tcp
      - 9300:9300/tcp
    environment:
      # Bootstrap password.
      # Used to initialize the keystore during the initial startup of
      # Elasticsearch. Ignored on subsequent runs.
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:-}
      # Use single node discovery in order to disable production mode and avoid bootstrap checks.
      # see: https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
      discovery.type: single-node
    networks:
      - elk
      - edgex-network

  kibana:
    image: kibana:${ELASTIC_VERSION}
    volumes:
      - ./log-analytics/kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml:ro,Z
    ports:
      - 5601:5601/tcp
    environment:
      KIBANA_SYSTEM_PASSWORD: ${KIBANA_SYSTEM_PASSWORD:-}
    networks:
      - elk
      - edgex-network
    depends_on:
      - elasticsearch

  filebeat:
    image: docker.elastic.co/beats/filebeat:${ELASTIC_VERSION}
    # Run as 'root' instead of 'filebeat' (uid 1000) to allow reading
    # 'docker.sock' and the host's filesystem.
    user: root
    command:
      # Log to stderr.
      - -e
      # Disable config file permissions checks. Allows mounting
      # 'config/filebeat.yml' even if it's not owned by root.
      # see: https://www.elastic.co/guide/en/beats/libbeat/current/config-file-permissions.html
      - --strict.perms=false
    volumes:
      - ./log-analytics/filebeat/config/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro,Z
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:-}
    networks:
      - elk
      - edgex-network
    restart: always
    depends_on:
      - elasticsearch
      - kibana
      - setup

volumes:
  setup: {}
  elasticsearch: {}