Basis image for running ELK in a docker container

• based on phusion/baseimage (sshd removed)
• oracle JRE 8
• elasticsearch 1.4.2
• logstash 1.4.2
• kibana 4.0.0 (beta3)

Example Docker Run

docker run -d -v /srv/data:/data --env ES_HEAP_SIZE=512m --env START="elasticsearch,logstash,kibana" --name elk --net=host propertybase/elk
docker run -d -v /srv/data:/data --env ES_HEAP_SIZE=512m --env START="elasticsearch" --name elk --net=host propertybase/elk

Start apps in the container

By default all apps are managed by the baseimage runit supervisor. All services are marked as down.

The down file get's removed on system startup by the 90_start_services.sh if the name of the service is mentioned in the ENV START variable.

e.g. You can start only elasticsearch by setting ENV START elasticsearch in your Dockerfile or --env START variable.

Config Files

Please extend this image for your own config files

List of config files:

• image/config_files/elasticsearch.yml -> /etc/elasticsearch/elasticsearch.yml
• image/config_files/logging.yml -> /etc/elasticsearch/logging.yml
• image/config_files/logstash.conf -> /etc/logstash.conf
• image/config_files/kibana.yml -> /usr/local/kibana/config/kibana.yml

Some configurations (especially Elasticsearch) are made with environment variables. Check the Dockerfile for override possibilities.

Make sure to at least set your ES_HEAP_SIZE to half your RAM and not more than 32g http://www.elasticsearch.org/guide/en/elasticsearch/guide/current/heap-sizing.html

Volumes

There is a /data volume to persist the Elasticsearch db.