first version

.env

@@ -0,0 +1,2 @@
+ELASTIC_USER=myadmin
+ELASTIC_PASSWORD=mypassw0rd!

docker-compose.yml

@@ -0,0 +1,68 @@
+services:
+  elasticsearch:
+    image: docker.elastic.co/elasticsearch/elasticsearch:9.0.2
+    container_name: elasticsearch
+    environment:
+      - node.name=elasticsearch
+      - discovery.type=single-node
+      - xpack.security.enabled=true
+      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
+    ports:
+      - "9200:9200"
+    volumes:
+      - esdata:/usr/share/elasticsearch/data
+    networks:
+      - elk
+
+  kibana:
+    image: docker.elastic.co/kibana/kibana:9.0.2
+    container_name: kibana
+    environment:
+      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
+      - ELASTICSEARCH_USERNAME=${ELASTIC_USER}
+      - ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD}
+    ports:
+      - "5601:5601"
+    depends_on:
+      - elasticsearch
+    networks:
+      - elk
+
+  logstash:
+    image: docker.elastic.co/logstash/logstash:9.0.2
+    container_name: logstash
+    environment:
+      - xpack.monitoring.enabled=true
+      - ELASTIC_USERNAME=${ELASTIC_USER}
+      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
+    ports:
+      - "5044:5044"
+    volumes:
+      - ./logstash/pipeline:/usr/share/logstash/pipeline
+    depends_on:
+      - elasticsearch
+    networks:
+      - elk
+
+  filebeat:
+    image: docker.elastic.co/beats/filebeat:9.0.2
+    container_name: filebeat
+    user: root
+    environment:
+      - ELASTICSEARCH_USERNAME=${ELASTIC_USER}
+      - ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD}
+    volumes:
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
+    depends_on:
+      - logstash
+    networks:
+      - elk
+    command: ["--strict.perms=false"]
+
+volumes:
+  esdata:
+
+networks:
+  elk:

filebeat/filebeat.yml

@@ -0,0 +1,22 @@
+filebeat.inputs:
+  - type: filestream
+    id: my-container-logs
+    enabled: true
+    paths:
+      - /var/lib/docker/containers/*/*.log
+    parser:
+      - docker
+
+output.logstash:
+  hosts: ["logstash:5044"]
+  username: "${ELASTIC_USER}"
+  password: "${FILEBEAT_PASSWORD}"
+
+setup.kibana:
+  host: "kibana:5601"
+  username: "${ELASTIC_USER}"
+  password: "${FILEBEAT_PASSWORD}"
+
+# Optional for debugging
+logging.level: info
+logging.to_files: false

logstash/pipeline/logstash.conf

@@ -0,0 +1,14 @@
+input {
+  beats {
+    port => 5044
+  }
+}
+
+output {
+  elasticsearch {
+    hosts => ["http://elasticsearch:9200"]
+    user => "myadmin"
+    password => "mypassw0rd!"
+    index => "logstash-%{+YYYY.MM.dd}"
+  }
+}