How to Setup a Docker ELK (Elastic Logstash Kibana) stack in a jiffy.

The What’s What…

Docker is an open platform for developers and sysadmins to build, ship, and run distributed applications by providing extremely lightweight operating-system-level virtualization also known as containers.

ELK is the acronym for three open source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server‑side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a “stash” like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch.

Okay so what next?

We are going to run the ELK stack in docker containers. This is so cool because containers are lightweight (again), increase isolation therefore security and can literally run anywhere. I will assume you’re familiar with basic docker concepts and you have docker-compose installed. So let’s get started!

Step 1

I searched and searched the web for the perfect docker-compose file and I found this great repo that helps set up the whole stack easily.

Open your terminal and clone the repo like this:

git clone https://github.com/deviantony/docker-elk.git

Step 2

After cloning the repo, cd into the newly created directory and list all the files. You will see a docker-compose.yml file. We need to make a tiny little change to it to persist our data just in case our stack goes down. We will do that by adding a named docker volume like so…

elasticsearch:
    build:
      context: elasticsearch
    volumes:
      ...
      - esdata:/usr/share/elasticsearch/data
...
# declare your docker volume
volumes:
  esdata:
    driver: local

And that’s it! Save the file and run

docker-compose up

That’s all you need to get started with the ELK stack on docker. Now of course there is no data you are currently feeding into logstash but you could try and download a sample csv file and play around with the logstash config file and you’re on.