docker-compose.yml

version: '3.7'
# based on: https://github.com/maxyermayank/docker-compose-elasticsearch-kibana/blob/master/docker-compose.yml
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.4.0
    container_name: elasticsearch
    environment:
      - node.name=es01
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms1G -Xmx10G"
#    ulimits:
#      nproc: 65535
#      memlock:
#        soft: -1
#        hard: -1

    cap_add:
      - ALL

    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
#      resources:
#        limits:
#          cpus: '16'
#          memory: 10G
#        reservations:
#          cpus: '1'
#          memory: 256M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 10s

    volumes:
      - type: volume
        source: logs
        target: /var/log
      - type: volume
        source: esdata1
        target: /usr/share/elasticsearch/data

    networks:
      - elastic
    ports:
      - 9200:9200
      - 9300:9300

  kibana:
    image: docker.elastic.co/kibana/kibana:7.2.0
    container_name: kibana
    environment:
      - SERVER_NAME=localhost
      - ELASTICSEARCH_URL=http://elasticsearch:9200
    ports:
      - 5601:5601
    volumes:
      - type: volume
        source: logs
        target: /var/log
    ulimits:
      nproc: 65535
      memlock:
        soft: -1
        hard: -1
    cap_add:
      - ALL
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        delay: 10s
      resources:
        limits:
          cpus: '1'
          memory: 256M
        reservations:
          cpus: '1'
          memory: 256M
      restart_policy:
        condition: on-failure
        delay: 30s
        max_attempts: 3
        window: 120s
    networks:
      - elastic
    depends_on:
      - 'elasticsearch'

  auditbeat:
    image: docker.elastic.co/beats/auditbeat:7.2.0
    command: auditbeat -e -strict.perms=false
    user: root
    environment:
      - setup.kibana.host=kibana:5601
      - output.elasticsearch.hosts=["elasticsearch:9200"]
    cap_add: ['AUDIT_CONTROL', 'AUDIT_READ']
    pid: "host"
    volumes:
    #   - ${PWD}/configs/auditbeat.docker.yml:/usr/share/auditbeat/auditbeat.yml
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - elastic
  metricbeat:
    image: docker.elastic.co/beats/metricbeat:7.2.0
    # command: --strict.perms=false
    environment:
      - setup.kibana.host=kibana:5601
      - output.elasticsearch.hosts=["elasticsearch:9200"]
    cap_add:
      - AUDIT_CONTROL
      - AUDIT_READ
    volumes:
      # - ${PWD}/configs/metricbeat.docker.yml:/usr/share/metricbeat/metricbeat.yml
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /proc:/hostfs/proc:ro
      - /:/hostfs:ro
    networks:
      - elastic

  heartbeat:
    image: docker.elastic.co/beats/heartbeat:7.2.0
    command: --strict.perms=false
    environment:
      - setup.kibana.host=kibana:5601
      - output.elasticsearch.hosts=["elasticsearch:9200"]
    # volumes:
    #   - ${PWD}/configs/heartbeat.docker.yml:/usr/share/heartbeat/heartbeat.yml
    networks:
      - elastic

  packetbeat:
    image: docker.elastic.co/beats/packetbeat:7.2.0
    command: --strict.perms=false
    environment:
      - setup.kibana.host=kibana:5601
      - output.elasticsearch.hosts=["elasticsearch:9200"]
    cap_add:
      - NET_RAW
      - NET_ADMIN
    # volumes:
    #   - ${PWD}/configs/packetbeat.docker.yml:/usr/share/packetbeat/packetbeat.yml
    networks:
      - elastic

  filebeat:
    image: docker.elastic.co/beats/filebeat:7.2.0
    command: --strict.perms=false
    environment:
      - setup.kibana.host=kibana:5601
      - output.elasticsearch.hosts=["elasticsearch:9200"]
    ports:
      - 9000:9000
    volumes:
      # - ${PWD}/configs/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - elastic
  apmserver:
    image: docker.elastic.co/apm/apm-server:7.2.0
    command: --strict.perms=false
    ports:
      - 8200:8200
      - 8201:8200
    environment:
      - apm-server.host=0.0.0.0
      - setup.kibana.host=kibana:5601
      - output.elasticsearch.hosts=["elasticsearch:9200"]
    # volumes:
    #   - ${PWD}/configs/apm-server.yml:/usr/share/apm-server/apm-server.yml
    networks:
        - elastic
  app-search:
    image: docker.elastic.co/app-search/app-search:7.2.0
    ports:
      - 3002:3002
    environment:
      secret_session_key: supersecretsessionkey
      elasticsearch.host: http://elasticsearch1:9200/
      allow_es_settings_modification: "true"
    networks:
        - elastic

volumes:
  esdata1:
  logs:

networks:
  elastic: