EFK log collection stack (Elasticsearch, Fluent Bit, Kibana) setup for development.

docker-compose.yml

version: "3.8"

services:
  elasticsearch:
    image: elasticsearch:8.5.2
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    environment:
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
      - discovery.type=single-node
      - xpack.security.enabled=false
    restart: always

  fluent-bit:
    image: fluent/fluent-bit:1.9.10
    ports:
      - "24224:24224"
    volumes:
      - ./fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf
      - ./fluent-bit-parsers.conf:/fluent-bit/etc/parsers.conf
    restart: always

  kibana:
    image: kibana:8.5.2
    ports:
      - "5601:5601"
    restart: always

  # Any application that outputs logs in JSON format.
  # Each record must contain time in RFC3339 nano format inside "time" field.
  dummylog:
    image: dummylog
    command: -format=json
    logging:
      driver: fluentd
      options:
        tag: docker.json_rfc3339_nano

volumes:
  elasticsearch-data:

fluent-bit-parsers.conf

[PARSER]
  Name json_rfc3339_nano
  Format json
  Time_Key time
  # RFC3339 Nano (2006-01-02T15:04:05.999999999Z07:00)
  Time_Format %Y-%m-%dT%H:%M:%S.%L%z

fluent-bit.conf

[SERVICE]
  Flush 1
  Parsers_File ./parsers.conf

[INPUT]
  Name forward

[FILTER]
  Name parser
  Match docker.json_rfc3339_nano
  Parser json_rfc3339_nano
  Key_Name log
  Reserve_Data On

[OUTPUT]
  Name es
  Match docker.*
  Host elasticsearch
  Logstash_Format On
  Logstash_Prefix docker-logs
  Suppress_Type_Name On