ELK : elasticsearch + logstash + kibana

• Version : 5.0.1
• Version : 5.3.1 + docker-compose.yml for linux, docker-compose.yml for docker_for_mac
• Version : 5.6.3 + docker-compose.yml for linux, docker-compose.yml for docker_for_mac
• Version : 6.0.0 + docker-compose.yml for linux, docker-compose.yml for docker_for_mac
• Version : 6.1.2 + docker-compose.yml for linux, docker-compose.yml for docker_for_mac

Forwarder : filebeat port 5044

• OS : Centos 7.x
• Docker engine > 1.12.x
• Docker-compose > 1.11.x

cd ~
git clone https://github.com/easonlau02/elasticstack.git

• Replace <your_es_host> with your running host for below config

~/elasticstack/5.3.1/docker-compose.yml.docker_for_mac

• For linux user

cd ~/elaticstack/5.3.1
docker-compose -f docker-compose.yml.linux up -d

• For Mac user

cd ~/elasticstack/5.3.1
docker-compose -f docker-compose.yml.docker_for_mac up -d

You can see Unable to fetch mapping. Do you have indices match..., caused by no log feed.

We managed all config file in images eason02/elk-data-volume:5.3.1, so if you need to change/add config for below folder.

~/elasticstack/5.3.1/elasticsearch/config/
~/elasticstack/5.3.1/logstash/config/
~/elasticstack/5.3.1/kibana/config/

And then run below related scripts to build new config image eason02/elk-data-volume:5.3.1.

cd ~/elasticstack/5.3.1/
chmod +x build_data_volumes_for_elk.sh
./build_data_volumes_for_elk.sh

Restart elk service to take effect.

• For linux user:

cd ~/elasticstack/5.3.1/
docker-compose -f docker-compose.yml.linux restart

• For Mac user:

cd ~/elasticstack/5.3.1/
docker-compose -f docker-compose.yml.docker_for_mac restart