From ca48fb9b87d60b423e5be3f36339970dde30a6e3 Mon Sep 17 00:00:00 2001
From: "stephane.david" <thedaryt@outlook.fr>
Date: Sat, 14 Mar 2026 16:20:35 +0100
Subject: [PATCH] first version

---
 .env                            |  2 +
 docker-compose.yml              | 68 +++++++++++++++++++++++++++++++++
 filebeat/filebeat.yml           | 22 +++++++++++
 logstash/pipeline/logstash.conf | 14 +++++++
 4 files changed, 106 insertions(+)
 create mode 100644 .env
 create mode 100644 docker-compose.yml
 create mode 100644 filebeat/filebeat.yml
 create mode 100644 logstash/pipeline/logstash.conf

diff --git a/.env b/.env
new file mode 100644
index 0000000..146a615
--- /dev/null
+++ b/.env
@@ -0,0 +1,2 @@
+ELASTIC_USER=myadmin
+ELASTIC_PASSWORD=mypassw0rd!
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..535969a
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,68 @@
+services:
+  elasticsearch:
+    image: docker.elastic.co/elasticsearch/elasticsearch:9.0.2
+    container_name: elasticsearch
+    environment:
+      - node.name=elasticsearch
+      - discovery.type=single-node
+      - xpack.security.enabled=true
+      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
+    ports:
+      - "9200:9200"
+    volumes:
+      - esdata:/usr/share/elasticsearch/data
+    networks:
+      - elk
+
+  kibana:
+    image: docker.elastic.co/kibana/kibana:9.0.2
+    container_name: kibana
+    environment:
+      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
+      - ELASTICSEARCH_USERNAME=${ELASTIC_USER}
+      - ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD}
+    ports:
+      - "5601:5601"
+    depends_on:
+      - elasticsearch
+    networks:
+      - elk
+
+  logstash:
+    image: docker.elastic.co/logstash/logstash:9.0.2
+    container_name: logstash
+    environment:
+      - xpack.monitoring.enabled=true
+      - ELASTIC_USERNAME=${ELASTIC_USER}
+      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
+    ports:
+      - "5044:5044"
+    volumes:
+      - ./logstash/pipeline:/usr/share/logstash/pipeline
+    depends_on:
+      - elasticsearch
+    networks:
+      - elk
+
+  filebeat:
+    image: docker.elastic.co/beats/filebeat:9.0.2
+    container_name: filebeat
+    user: root
+    environment:
+      - ELASTICSEARCH_USERNAME=${ELASTIC_USER}
+      - ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD}
+    volumes:
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
+    depends_on:
+      - logstash
+    networks:
+      - elk
+    command: ["--strict.perms=false"]
+
+volumes:
+  esdata:
+
+networks:
+  elk:
\ No newline at end of file
diff --git a/filebeat/filebeat.yml b/filebeat/filebeat.yml
new file mode 100644
index 0000000..a1536b5
--- /dev/null
+++ b/filebeat/filebeat.yml
@@ -0,0 +1,22 @@
+filebeat.inputs:
+  - type: filestream
+    id: my-container-logs
+    enabled: true
+    paths:
+      - /var/lib/docker/containers/*/*.log
+    parser:
+      - docker
+
+output.logstash:
+  hosts: ["logstash:5044"]
+  username: "${ELASTIC_USER}"
+  password: "${FILEBEAT_PASSWORD}"
+
+setup.kibana:
+  host: "kibana:5601"
+  username: "${ELASTIC_USER}"
+  password: "${FILEBEAT_PASSWORD}"
+
+# Optional for debugging
+logging.level: info
+logging.to_files: false
\ No newline at end of file
diff --git a/logstash/pipeline/logstash.conf b/logstash/pipeline/logstash.conf
new file mode 100644
index 0000000..e5bb43e
--- /dev/null
+++ b/logstash/pipeline/logstash.conf
@@ -0,0 +1,14 @@
+input {
+  beats {
+    port => 5044
+  }
+}
+
+output {
+  elasticsearch {
+    hosts => ["http://elasticsearch:9200"]
+    user => "myadmin"
+    password => "mypassw0rd!"
+    index => "logstash-%{+YYYY.MM.dd}"
+  }
+}
\ No newline at end of file