elastic-log-kibana

docker-compose.yml

version: '3'

services:
  elasticsearch:
    image: elasticsearch:7.12.1
    environment:
      - discovery.type=single-node
    ports:
      - "9200:9200"
      - "9300:9300"
    networks:
      - elastic-network

  kibana:
    image: kibana:7.12.1
    environment:
      ELASTIC_HOST: elasticsearch-0:9200
      XPACK_SECURITY_ENABLED: "false"
      XPACK_REPORTING_ENABLED: "false"
      XPACK_MONITORING_ENABLED: "false"
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch
    links:
      - "elasticsearch"
    networks:
      - elastic-network

  logstash:
    image: logstash:7.12.1
    ports:
      - "5044:5044"
    links:
      - "elasticsearch"
    depends_on:
      - elasticsearch
      - kibana
    volumes: 
      - "./logstash.conf:/usr/share/logstash/config/logstash.conf:ro"
    networks:
      - elastic-network
  filebeat:
    image: elastic/filebeat:7.12.1
    env_file:
      - filebeat.env
    links:
      - "logstash"
    depends_on:
      - logstash
      - elasticsearch
      - kibana
    volumes: 
      - "./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
      - "./files:/usr/share/filebeat/files"
    networks:
      - elastic-network
networks: 
  elastic-network:
    driver: bridge

filebeat.env

setup.kibana.host=elk_kibana_1:5601
output.elasticsearch.hosts=["elk_elasticsearch_1:9200"]

filebeat.yml

filebeat.inputs:
- type: log
  source: 'FileBeat'
  paths:
  - /usr/share/filebeat/files/*
  enabled: true

setup.kibana:
  host: "elk_kibana_1:5601"

output.logstash:
  hosts: ["elk_logstash_1:5044"]

logstash.conf

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    host => "elk_filebeat_1"
    port => 5044
  }
}

grok {
    match => ["message", "%{TIMESTAMP_ISO8601:time} %{LOGLEVEL:log_level} %{GREEDYDATA:some_data} transactionId %{WORD:transaction_id}"]
}

output {
  elasticsearch {
    hosts => ["http://elk_elasticsearch_1:9200"]
    index => "%{type}-index"
  }
  stdout { codec => rubydebug }
}