BELK stack 7.2.0 example with Docker

BELK stack in docker to read logs from log directory with Filebeat, parse in Logstash, store in Elasticsearch and display in Kibana. Logs are from 23/Jul/2019 to 29/Jul/2019 (take a look on that to search in Kibana).

In some cases, it is need to set up the vm.max_map_count=262144 for Elasticsearch.

The example data are from the month of July 2019. The logs will be read from the ./logs/ directory.

Tested on docker 2.0.0.3

Build and start environment

docker-compose up -d

or stop and start environment

docker-compose stop
docker-compose up -d

or delete and restart environment

docker-compose rm -fs
docker-compose up -d

Stop environment

docker-compose stop

Reset a service

Instead of restart the application, just restart the container:

docker restart container_name

Kibana access

http://localhost:5601/

Elasticsearch API access

curl http://localhost:9200/

Logs

All logs

docker-compose logs -f

Single container

docker logs -f container_name

Get bash in a container

docker exec -it container_name bash

Directory layout

• Config for Elasticsearch, Logstash, Filebeat and Kibana: ../config/
• Logs to be read by Filebeat: ../logs/
• docker-compose.yml: the definition of BELK architecture