docker-compose.elastic.yml

---
services:
  fleet-server:
    image: docker.elastic.co/beats/elastic-agent:${ELASTIC__STACK_VERSION}
    restart: unless-stopped
    mem_limit: 256M
    labels:
      co.elastic.logs/enabled: false
      co.elastic.metrics/enabled: false
    depends_on:
      elasticsearch:
        condition: service_healthy
      kibana:
        condition: service_healthy
      kibana_setup:
        condition: service_completed_successfully
    user: root #/var/run/docker.sock
    environment:
      FLEET_SERVER_ENABLE: "1"
      FLEET_SERVER_POLICY_ID: fleet-server
      FLEET_SERVER_ELASTICSEARCH_HOST: http://elasticsearch:9200
      FLEET_SERVER_ELASTICSEARCH_USERNAME: elastic
      FLEET_SERVER_ELASTICSEARCH_PASSWORD: $ELASTIC__INITIAL_PASSWORD
      FLEET_SERVER_INSECURE_HTTP: true
      FLEET_SERVER_HOST: "0.0.0.0"
      KIBANA_FLEET_SETUP: true
      KIBANA_HOST: http://kibana:5601
      KIBANA_USERNAME: elastic
      KIBANA_PASSWORD: $ELASTIC__INITIAL_PASSWORD
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    container_name: fleet-server
    hostname: fleet-server
    networks:
      - oam
    healthcheck:
      interval: 10s
      retries: 12
      test: curl -s http://localhost:8220/api/status | grep -q '"status":"HEALTHY"'

  apm:
    image: docker.elastic.co/beats/elastic-agent:${ELASTIC__STACK_VERSION}
    restart: unless-stopped
    mem_limit: 256M
    labels:
      co.elastic.logs/enabled: false
      co.elastic.metrics/enabled: false
    depends_on:
      elasticsearch:
        condition: service_healthy
      kibana:
        condition: service_healthy
      fleet-server:
        condition: service_healthy
    user: root #/var/run/docker.sock
    environment:
      FLEET_ENROLL: 1
      FLEET_URL: http://fleet-server:8220
      FLEET_INSECURE: true
      FLEET_TOKEN_POLICY_NAME: apm
      FLEET_TOKEN_NAME: Default
      KIBANA_FLEET_HOST: http://kibana:5601
      KIBANA_FLEET_USERNAME: elastic
      KIBANA_FLEET_PASSWORD: $ELASTIC__INITIAL_PASSWORD
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
      ELASTICSEARCH_USERNAME: elastic
      ELASTICSEARCH_PASSWORD: $ELASTIC__INITIAL_PASSWORD
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    container_name: apm
    hostname: apm
    ports:
      - 8200:8200
    networks:
      - oam
    healthcheck:
      interval: 10s
      retries: 12
      test: curl -s http://localhost:8200 | grep -q '"publish_ready":\ true'

  filebeat:
    image: docker.elastic.co/beats/filebeat:${ELASTIC__STACK_VERSION}
    restart: unless-stopped
    mem_limit: 256M
    labels:
      co.elastic.logs/enabled: false
      co.elastic.metrics/raw: "[{\"module\":\"beat\",\"hosts\":\"filebeat:5066\",\"period\":\"10s\",\"xpack.enabled\":\"true\"}]"
    depends_on:
      elasticsearch:
        condition: service_healthy
      kibana:
        condition: service_healthy
    user: root #/var/run/docker.sock
    entrypoint: []
    command: >
      bash -c '
        filebeat -e \
          -E setup.kibana.enabled=true \
          -E setup.kibana.host=http://kibana:5601 \
          -E setup.dashboards.enabled=true \
          -E setup.template.enabled=true \
          -E setup.template.settings.index.number_of_replicas=0 \
          -E http.enabled=true \
          -E http.host=0.0.0.0 \
          -E http.port=5066 \
          -E monitoring.enabled=false \
          -E output.elasticsearch.username=elastic \
          -E output.elasticsearch.password=$ELASTIC__INITIAL_PASSWORD \
          -E output.elasticsearch.hosts=["http://elasticsearch:9200"] \
          -E monitoring.cluster_uuid=$(cat /usr/share/setup/cluster_uuid) \
      '
    volumes:
      - ./elastic/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - elasticsearch_setup:/usr/share/setup:ro
    container_name: filebeat
    hostname: filebeat
    networks:
      - oam
    healthcheck:
      interval: 10s
      retries: 12
      test: curl --write-out 'HTTP %{http_code}' --fail --silent --output /dev/null http://localhost:5066/

  metricbeat:
    image: docker.elastic.co/beats/metricbeat:${ELASTIC__STACK_VERSION}
    restart: unless-stopped
    mem_limit: 256M
    labels:
      co.elastic.logs/enabled: false
      co.elastic.metrics/raw: "[{\"module\":\"beat\",\"hosts\":\"metricbeat:5066\",\"period\":\"10s\",\"xpack.enabled\":\"true\"}]"
    depends_on:
      elasticsearch:
        condition: service_healthy
      kibana:
        condition: service_healthy
    user: root #/var/run/docker.sock
    entrypoint: []
    command: >
      bash -c '
        metricbeat -e \
          -E setup.kibana.enabled=true \
          -E setup.kibana.host=http://kibana:5601 \
          -E setup.dashboards.enabled=true \
          -E setup.template.enabled=true \
          -E setup.template.settings.index.number_of_replicas=0 \
          -E http.enabled=true \
          -E http.host=0.0.0.0 \
          -E http.port=5066 \
          -E monitoring.enabled=false \
          -E output.elasticsearch.username=elastic \
          -E output.elasticsearch.password=$ELASTIC__INITIAL_PASSWORD \
          -E output.elasticsearch.hosts=["http://elasticsearch:9200"] \
          -E monitoring.cluster_uuid=$(cat /usr/share/setup/cluster_uuid) \
      '
    volumes:
      - ./elastic/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml:ro
      - ./elastic/metricbeat/system.yml:/usr/share/metricbeat/modules.d/system.yml
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - elasticsearch_setup:/usr/share/setup:ro
    container_name: metricbeat
    hostname: metricbeat
    networks:
      - oam
    healthcheck:
      interval: 10s
      retries: 12
      test: curl --write-out 'HTTP %{http_code}' --fail --silent --output /dev/null http://localhost:5066/

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC__STACK_VERSION}
    restart: unless-stopped
    mem_limit: 5G
    labels:
      co.elastic.logs/enabled: true
      co.elastic.logs/module: elasticsearch
      co.elastic.logs/fileset: server
      co.elastic.metrics/raw: "[{\"module\":\"elasticsearch\",\"hosts\":\"http://elasticsearch:9200\",\"period\":\"10s\",\"xpack.enabled\":\"true\",\"username\":\"elastic\",\"password\":\"$ELASTIC__INITIAL_PASSWORD\"}]"
    environment:
      - cluster.name=datacenter
      - xpack.license.self_generated.type=trial
      - bootstrap.memory_lock=true
      - cluster.routing.allocation.disk.threshold_enabled=false
      - discovery.type=single-node
      - xpack.security.enabled=true
      - xpack.security.authc.api_key.enabled=true
      - xpack.monitoring.collection.enabled=true
      - xpack.monitoring.elasticsearch.collection.enabled=false
      - ELASTIC_PASSWORD=$ELASTIC__INITIAL_PASSWORD
      - ES_JAVA_OPTS=-Xms4g -Xmx4g
    ulimits:
      memlock:
        hard: -1
        soft: -1
    volumes:
      - esdata:/usr/share/elasticsearch/data
    ports:
      - 9200:9200
    container_name: elasticsearch
    hostname: elasticsearch
    networks:
      - oam
    healthcheck:
      test: curl -u elastic:$$ELASTIC_PASSWORD -s http://localhost:9200/_cluster/health | grep -vq '"status":"red"'
      interval: 20s
      retries: 10

  elasticsearch_setup:
    image: alpine:${ALPINE_VERSION}
    user: root #to store cluster_uuid
    labels:
      co.elastic.logs/enabled: false
      co.elastic.metrics/enabled: false
    depends_on:
      elasticsearch:
        condition: service_healthy
    command: >
      sh -c '
        apk add curl;
        echo "Waiting for Elasticsearch availability";
        until curl -s -u elastic:${ELASTIC__INITIAL_PASSWORD} http://elasticsearch:9200/_cluster/health | grep -vq '"'"'"status":"red"'"'"'; do sleep 30; done;
        echo "Setting kibana_system password";
        until curl -s -X POST -u elastic:${ELASTIC__INITIAL_PASSWORD} -H "Content-Type: application/json" http://elasticsearch:9200/_security/user/kibana_system/_password -d '"'"'{"password":"${ELASTIC__INITIAL_PASSWORD}"}'"'"' | grep -q "^{}"; do sleep 10; done;
        echo "Storing cluster_uuid";
        until curl -s -u elastic:${ELASTIC__INITIAL_PASSWORD} http://elasticsearch:9200/ | grep cluster_uuid | awk '"'"'{split($0,a,":"); print a[2]}'"'"' | sed '"'"'s/[\", ]//g'"'"' > /usr/share/setup/cluster_uuid; do sleep 10; done;
        echo "All done!";
      '
    container_name: elasticsearch_setup
    volumes:
      - elasticsearch_setup:/usr/share/setup
    networks:
      - oam

  kibana:
    image: docker.elastic.co/kibana/kibana:${ELASTIC__STACK_VERSION}
    restart: unless-stopped
    mem_limit: 1G
    labels:
      co.elastic.logs/enabled: false
      co.elastic.logs/module: kibana
      co.elastic.logs/fileset: log
      co.elastic.metrics/raw: "[{\"module\":\"kibana\",\"hosts\":\"http://kibana:5601\",\"period\":\"10s\",\"xpack.enabled\":\"true\",\"username\":\"kibana_system\",\"password\":\"$ELASTIC__INITIAL_PASSWORD\"}]"
    depends_on:
      elasticsearch:
        condition: service_healthy
      elasticsearch_setup:
        condition: service_completed_successfully
    environment:
      ELASTICSEARCH_URL: http://elasticsearch:9200
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
      ELASTICSEARCH_USERNAME: kibana_system
      ELASTICSEARCH_PASSWORD: $ELASTIC__INITIAL_PASSWORD
      XPACK_APM_AUTOCREATEAPMINDEXPATTERN: true
      XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY: $ELASTIC__ENCRYPTION_KEY
      XPACK_SECURITY_ENCRYPTIONKEY: $ELASTIC__ENCRYPTION_KEY
      XPACK_REPORTING_ENCRYPTIONKEY: $ELASTIC__ENCRYPTION_KEY
      XPACK_FLEET_AGENTS_FLEET_SERVER_HOSTS: '["http://fleet-server:8220"]'
      XPACK_FLEET_AGENTS_ELASTICSEARCH_HOSTS: '["http://elasticsearch:9200"]'
    volumes:
      - ./elastic/kibana.yml:/usr/share/kibana/config/kibana.yml
      - kibanadata:/usr/share/kibana/data
    ports:
      - 5601:5601
    container_name: kibana
    hostname: kibana
    networks:
      - oam
    healthcheck:
      interval: 10s
      retries: 20
      test: curl -u kibana_system:$$ELASTICSEARCH_PASSWORD -f -s -o /dev/null http://localhost:5601/api/status

  kibana_setup:
    image: alpine:${ALPINE_VERSION}
    labels:
      co.elastic.logs/enabled: false
      co.elastic.metrics/enabled: false
    depends_on:
      kibana:
        condition: service_healthy
    environment:
      ELASTICSEARCH_PASSWORD: $ELASTIC__INITIAL_PASSWORD
    command: >
      sh -c '
        apk add curl;
        echo "Waiting for Kibana API availability";
        until curl -u kibana_system:$$ELASTICSEARCH_PASSWORD -f -s -o /dev/null http://kibana:5601/api/status; do sleep 30; done;
        echo "Update default space";
        until curl -s -X PUT -u elastic:${ELASTIC__INITIAL_PASSWORD} -H "Content-Type: application/json" -H "kbn-xsrf: true" http://kibana:5601/api/spaces/space/default -d @/usr/share/setup/spaces/default.json | grep -q "default"; do sleep 10; done;

        echo "Update package policies";
        until curl -s -X POST -u elastic:${ELASTIC__INITIAL_PASSWORD} -H "Content-Type: application/json" -H "kbn-xsrf: true" http://kibana:5601/api/fleet/package_policies -d @/usr/share/setup/package_policies/cloud-security-posture.json | grep -q "kspm\|already"; do sleep 10; done;

        echo "All done!";
      '
    container_name: kibana_setup
    volumes:
      - ./elastic/kibana_setup:/usr/share/setup
    networks:
      - oam

networks:
  oam:

volumes:
  elasticsearch_setup:
    driver: local
  esdata:
    driver: local
  kibanadata:
    driver: local