powered by Docker ELK stack
- Install Docker.
- Install Docker-compose version >= 1.6.
- Install Dialog
- Clone this repository
You need to increase max_map_count
on your Docker host:
$ sudo sysctl -w vm.max_map_count=262144
On distributions which have SELinux enabled out-of-the-box you will need to either re-context the files or set SELinux into Permissive mode in order for docker-elk to start properly. For example on Redhat and CentOS, the following will apply the proper context:
.-root@centos ~
-$ chcon -R system_u:object_r:admin_home_t:s0 docker-elk/
Start the pdml2flow-gui using up.sh:
$ ./up.sh
Then access Kibana UI by hitting http://localhost:5601 with a web browser. All you should have to do is to set the index name to pdml2flow-*
and hit the create button.
See: https://www.elastic.co/guide/en/kibana/current/setup.html#connect
By default, the stack exposes the following ports:
- 9200: Elasticsearch HTTP
- 9300: Elasticsearch TCP transport
- 5601: Kibana
WARNING: If you're using boot2docker, you must access it via the boot2docker IP address instead of localhost.
WARNING: If you're using Docker Toolbox, you must access it via the docker-machine IP address instead of localhost.
NOTE: Configuration is not dynamically reloaded, you will need to restart the stack after any change in the configuration of a component.
The Kibana default configuration is stored in kibana/config/kibana.yml
.
The Elasticsearch container is using the shipped configuration and it is not exposed by default.
If you want to override the default configuration, create a file elasticsearch/config/elasticsearch.yml
and add your configuration in it.
Then, you'll need to map your configuration file inside the container in the docker-compose.yml
. Update the elasticsearch container declaration to:
elasticsearch:
build: elasticsearch/
ports:
- "9200:9200"
- "9300:9300"
environment:
ES_JAVA_OPTS: "-Xms1g -Xmx1g"
networks:
- docker_elk
volumes:
- ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
You can also specify the options you want to override directly in the command field:
elasticsearch:
build: elasticsearch/
command: elasticsearch -Des.network.host=_non_loopback_ -Des.cluster.name: my-cluster
ports:
- "9200:9200"
- "9300:9300"
environment:
ES_JAVA_OPTS: "-Xms1g -Xmx1g"
networks:
- docker_elk
The data stored in Elasticsearch will be persisted after container reboot but not after container removal.
In order to persist Elasticsearch data even after removing the Elasticsearch container, you'll have to mount a volume on your Docker host. Update the elasticsearch container declaration to:
elasticsearch:
build: elasticsearch/
command: elasticsearch -Des.network.host=_non_loopback_ -Des.cluster.name: my-cluster
ports:
- "9200:9200"
- "9300:9300"
environment:
ES_JAVA_OPTS: "-Xms1g -Xmx1g"
networks:
- docker_elk
volumes:
- /path/to/storage:/usr/share/elasticsearch/data
This will store elasticsearch data inside /path/to/storage
.