Elastic Stack and GELF

The docker-compose configuration is the same as in section Creating the “docker-compose” File, but with a change to the Logstash part (note that the log entrypoint key would appear on a single line):

Elastic Stack docker-compose example 2

version: '2.2'

services:

elasticsearch:

build:

context: elasticsearch/

container_name: elasticsearch

volumes:

- monitoring-data:/usr/share/elasticsearch/data

ports:

- "9200:9200"

- "9300:9300"

environment:

ES_JAVA_OPTS: "-Xmx512m -Xms512m"

logstash:

image: docker.elastic.co/logstash/logstash:7.9.1

container_name: logstash

ports:

- "5000:5000"

- "5044:5044"

- "12201:12201/udp"

expose:

- "5044/tcp"

- "12201/udp"

logging:

driver: "json-file"

environment:

LS_JAVA_OPTS: "-Xmx256m -Xms256m"

entrypoint: logstash -e 'input { gelf { } } output { elasticsearch { id => "lls" hosts => ["http://elasticsearch:9200"] } }'

depends_on:

- elasticsearch

kibana:

image: docker.elastic.co/kibana/kibana:7.9.1

ports:

- "5601:5601"

depends_on:

- elasticsearch

volumes:

monitoring-data:

driver: local

The Filebeat agent is not required in this scenario.