[](https://gitter.im/deviantony/docker-elk?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
Run the latest version of the ELK (Elasticseach, Logstash, Kibana) stack with Docker and Docker-compose.
**Note**: This version can be run in [Vagrant](https://www.vagrantup.com/)
It will give you the ability to analyze any data set by using the searching/aggregation capabilities of Elasticseach and the visualization power of Kibana.
On distributions which have SELinux enabled out-of-the-box you will need to either re-context the files or set SELinux into Permissive mode in order for docker-elk to start properly.
For example on Redhat and CentOS, the following will apply the proper context:
You can also choose to run it in background (detached mode):
```bash
```console
$ docker-compose up -d
```
Now that the stack is running, you'll want to inject logs in it. The shipped logstash configuration allows you to send content via tcp:
Give Kibana a few seconds to initialize, then access the Kibana web UI by hitting
[http://localhost:5601](http://localhost:5601) with a web browser.
By default, the stack exposes the following ports:
* 5000: Logstash TCP input.
* 9200: Elasticsearch HTTP
* 9300: Elasticsearch TCP transport
* 5601: Kibana
**WARNING**: If you're using `boot2docker`, you must access it via the `boot2docker` IP address instead of `localhost`.
**WARNING**: If you're using *Docker Toolbox*, you must access it via the `docker-machine` IP address instead of
`localhost`.
Now that the stack is running, you will want to inject some log entries. The shipped Logstash configuration allows you
to send content via TCP:
```bash
```console
$ nc localhost 5000 < /path/to/logfile.log
```
And then access Kibana UI by hitting [http://localhost:5601](http://localhost:5601) with a web browser.
## Initial setup
*NOTE*: You'll need to inject data into logstash before being able to create a logstash index in Kibana. Then all you should have to do is to hit the create button.
This will automatically be marked as the default index pattern as soon as the Kibana UI is opened for the first time.
# Configuration
## Configuration
*NOTE*: Configuration is not dynamically reloaded, you will need to restart the stack after any change in the configuration of a component.
**NOTE**: Configuration is not dynamically reloaded, you will need to restart the stack after any change in the
configuration of a component.
## How can I tune Kibana configuration?
### How can I tune the Kibana configuration?
The Kibana default configuration is stored in `kibana/config/kibana.yml`.
## How can I tune Logstash configuration?
It is also possible to map the entire `config` directory instead of a single file.
The logstash configuration is stored in`logstash/config/logstash.conf`.
### How can I tune the Logstash configuration?
The folder `logstash/config` is mapped onto the container `/etc/logstash/conf.d` so you
can create more than one file in that folder if you'd like to. However, you must be aware that config files will be read from the directory in alphabetical order.
The Logstash configuration is stored in `logstash/config/logstash.yml`.
## How can I specify the amount of memory used by Logstash?
It is also possible to map the entire `config` directory instead of a single file, however you must be aware that
Logstash will be expecting a
[`log4j2.properties`](https://github.com/elastic/logstash-docker/tree/master/build/logstash/config) file for its own
logging.
The Logstash container use the *LS_HEAP_SIZE* environment variable to determine how much memory should be associated to the JVM heap memory (defaults to 500m).
### How can I tune the Elasticsearch configuration?
If you want to override the default configuration, add the *LS_HEAP_SIZE* environment variable to the container in the `docker-compose.yml`:
The Elasticsearch configuration is stored in `elasticsearch/config/elasticsearch.yml`.
You can also specify the options you want to override directly via environment variables:
```yml
logstash:
build: logstash/
command: -f /etc/logstash/conf.d/
volumes:
- ./logstash/config:/etc/logstash/conf.d
ports:
- "5000:5000"
networks:
- docker_elk
depends_on:
- elasticsearch
elasticsearch:
environment:
- LS_HEAP_SIZE=2048m
network.host:"_non_loopback_"
cluster.name:"my-cluster"
```
## How can I add Logstash plugins? ##
### How can I scale out the Elasticsearch cluster?
To add plugins to logstash you have to:
Follow the instructions from the Wiki: [Scaling out
1. Add a RUN statement to the `logstash/Dockerfile` (ex. `RUN logstash-plugin install logstash-filter-json`)
2. Add the associated plugin code configuration to the `logstash/config/logstash.conf` file
## Storage
## How can I enable a remote JMX connection to Logstash?
### How can I persist Elasticsearch data?
As for the Java heap memory, another environment variable allows to specify JAVA_OPTS used by Logstash. You'll need to specify the appropriate options to enable JMX and map the JMX port on the docker host.
The data stored in Elasticsearch will be persisted after container reboot but not after container removal.
Update the container in the `docker-compose.yml` to add the *LS_JAVA_OPTS* environment variable with the following content (I've mapped the JMX service on the port 18080, you can change that), do not forget to update the *-Djava.rmi.server.hostname* option with the IP address of your Docker host (replace **DOCKER_HOST_IP**):
In order to persist Elasticsearch data even after removing the Elasticsearch container, you'll have to mount a volume on
your Docker host. Update the `elasticsearch` service declaration to:
### How can I enable a remote JMX connection to a service?
## How can I store Elasticsearch data?
As for the Java Heap memory (see above), you can specify JVM options to enable JMX and map the JMX port on the docker
host.
The data stored in Elasticsearch will be persisted after container reboot but not after container removal.
In order to persist Elasticsearch data even after removing the Elasticsearch container, you'll have to mount a volume on your Docker host. Update the elasticsearch container declaration to:
Update the `{ES,LS}_JAVA_OPTS` environment variable with the following content (I've mapped the JMX service on the port
18080, you can change that). Do not forget to update the `-Djava.rmi.server.hostname` option with the IP address of your
