docker-compose.yaml

version: "3.9"

services:
  elasticsearch:
    image: elasticsearch:${ELASTICSEARCH_TAG}
    restart: unless-stopped
    stop_grace_period: 10s
    environment:
      discovery.type: single-node
      ES_JAVA_OPTS: -Xms1g -Xmx1g
      xpack.security.enabled: false
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    ports:
      - ${ELASTICSEARCH_PORT}:9200

  kibana:
    image: kibana:${KIBANA_TAG}
    restart: unless-stopped
    stop_grace_period: 10s
    ports:
      - ${KIBANA_PORT}:5601

  logstash:
    image: logstash:${LOGSTASH_TAG}
    restart: unless-stopped
    stop_grace_period: 10s
    ports:
      - ${LOGSTASH_PORT}:5044 
      - ${LOGSTASH_API_PORT}:9600
    volumes:
      - ./config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
      - ./pipeline:/usr/share/logstash/pipeline

  heartbeat:
    image: elastic/heartbeat:${HEARTBEAT_TAG}
    user: heartbeat
    restart: unless-stopped
    stop_grace_period: 10s
    cap_add:
      - NET_RAW
    volumes:
      - ./config/heartbeat.yml:/usr/share/heartbeat/heartbeat.yml:ro
    environment:
      ELASTICSEARCH_HOSTS: elasticsearch:9200
      KIBANA_HOSTS: kibana:5601
    command: ["--strict.perms=false"]

  metricbeat:
    image: elastic/metricbeat:${METRICBEAT_TAG}
    user: root
    restart: unless-stopped
    stop_grace_period: 10s
    cap_add:
      - sys_ptrace 
      - dac_read_search
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /proc:/hostfs/proc:ro
      - ./config/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml:ro
    environment:
      ELASTICSEARCH_HOSTS: elasticsearch:9200
      KIBANA_HOSTS: kibana:5601
    command: ["--strict.perms=false"]

  filebeat:
    image: elastic/filebeat:${FILEBEAT_TAG}
    user: root
    restart: unless-stopped
    stop_grace_period: 10s
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ./config/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
    environment:
      ELASTICSEARCH_HOSTS: elasticsearch:9200
      KIBANA_HOSTS: kibana:5601
    command: ["--strict.perms=false"]

  auditbeat:
    image: elastic/auditbeat:${AUDITBEAT_TAG}
    user: root
    restart: unless-stopped
    stop_grace_period: 10s
    pid: host 
    cap_add:
      - AUDIT_CONTROL
      - AUDIT_READ
    volumes:
      - ./config/auditbeat.yml:/usr/share/auditbeat/auditbeat.yml:ro
    environment:
      ELASTICSEARCH_HOSTS: elasticsearch:9200
      KIBANA_HOSTS: kibana:5601
      TINI_SUBREAPER: 1
    command: ["--strict.perms=false"]

networks:
  default:
    name: $PROJECT_NAME

volumes:
  elasticsearch-data: {}