docker-compose.yml

version: '3.8'

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.12.0
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false  # Disabling security for simplicity in dev
      - ES_JAVA_OPTS=-Xms1g -Xmx1g    # JVM heap size
    volumes:
      - es_data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"
      - "9300:9300"
    networks:
      - elk-network
    restart: unless-stopped

  logstash:
    image: docker.elastic.co/logstash/logstash:8.12.0
    container_name: logstash
    user: "0:0"
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
      - /var/log/auth.log:/var/log/auth.log:ro
    ports:
      - "5044:5044"   # Beats input
      - "5000:5000"    # TCP input
      - "9600:9600"    # Logstash API
    environment:
      - LS_JAVA_OPTS=-Xms1g -Xmx1g
    depends_on:
      - elasticsearch
    networks:
      - elk-network
    restart: unless-stopped

  kibana:
    image: docker.elastic.co/kibana/kibana:8.12.0
    container_name: kibana
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - SERVER_HOST=0.0.0.0
      - SERVER_NAME=kibana
    depends_on:
      - elasticsearch
    networks:
      - elk-network
    restart: unless-stopped

volumes:
  es_data:
    driver: local

networks:
  elk-network:
    driver: bridge