2021-02-06 ELK STACK

ELK Stack, docker-compose

version: '2.2'

services:
  traefik:
    image: "traefik:v2.1.2"
    container_name: "traefik"
    environment:
      - "TZ=Asia/Seoul"
    command:
      - "--log.level=error"
      - "--log.filepath=/opt/traefik/default.log"
      - "--log.format=json"
      - "--accesslog.filepath=/opt/traefik/access.log"
      - "--accesslog.format=json"

      - "--api.insecure=true"
      - "--api.dashboard=true"
      - "--api.debug=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.file.directory=/traefik/traefik.toml"

      - "--entrypoints.entrypoint-http.address=:80"
      - "--entrypoints.entrypoint-https.address=:443"
      - "--entrypoints.entrypoint-traefik.address=:8578"
      - "--entrypoints.entrypoint-redis.address=:8579"
      - "--entrypoints.entrypoint-inside-redis.address=:8580"

      - "--entrypoints.entrypoint-mt01.address=:12001"
      - "--entrypoints.entrypoint-mt02.address=:12002"
      - "--entrypoints.entrypoint-mt03.address=:12003"
      - "--entrypoints.entrypoint-cdn01.address=:12004"
      - "--entrypoints.entrypoint-cdn02.address=:12005"
      - "--entrypoints.entrypoint-data01.address=:12006"
      - "--entrypoints.entrypoint-data02.address=:12007"
      - "--entrypoints.entrypoint-data03.address=:12008"
      - "--entrypoints.entrypoint-ing01.address=:12009"
      - "--entrypoints.entrypoint-idx.address=:12010"
      - "--entrypoints.entrypoint-kibana.address=:12011"

      - "--certificatesresolvers.nanoit-cert.acme.httpchallenge=true"
      - "--certificatesresolvers.nanoit-cert.acme.httpchallenge.entrypoint=entrypoint-http"
      - "--certificatesresolvers.nanoit-cert.acme.email=${ACMEEMAIL}"
      - "--certificatesresolvers.nanoit-cert.acme.storage=/letsencrypt/acme.json"

    ports:
      - "80:80"
      - "443:443"
      - "8578:8578"
      - "8579:8579"

    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/home/operation/data/logs/traefik:/opt/traefik"
      - "/home/operation/data/htpasswd/userfile:/userfile"
      - "./letsencrypt:/letsencrypt"
      - "/etc/localtime:/etc/localtime:ro"
      - "./traefik:/traefik"

    networks:
      elastic-network:
        ipv4_address: 172.18.0.60

    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=elastic-network"
      - "traefik.http.services.dashboard-traefik.loadbalancer.server.port=8080"

      - "traefik.http.routers.secured-traefik.rule=Host(`${HOSTURL}`)"
      - "traefik.http.routers.secured-traefik.entrypoints=entrypoint-traefik"
      - "traefik.http.routers.secured-traefik.service=api@internal"
      - "traefik.http.routers.secured-traefik.tls=true"
      - "traefik.http.routers.secured-traefik.tls.certresolver=nanoit-cert"
      - "traefik.http.routers.secured-traefik.middlewares=basicauth-traefik@docker"
      - "traefik.http.middlewares.basicauth-traefik.basicauth.usersfile=/userfile"

  es-redis:
    image: redis:5.0.7
    container_name: es-redis
    restart: always
    sysctls:
      - net.core.somaxconn=511
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/redis:/data
      - /home/operation/app/elk-docker-compose/redis/redis.conf:/usr/local/etc/redis/redis.conf
      - /ssl:/usr/local/etc/redis
    networks:
      - elastic-network
    command: [ "redis-server", "/usr/local/etc/redis/redis.conf" ]
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.router-redis.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.router-redis.entrypoints=entrypoint-redis"
      - "traefik.tcp.routers.router-redis.service=frontend-redis@docker"
      - "traefik.tcp.routers.router-redis.tls=true"
      - "traefik.tcp.services.frontend-redis.loadbalancer.server.port=6379"

      - "traefik.tcp.routers.router-inside-redis.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.router-inside-redis.entrypoints=entrypoint-inside-redis"
      - "traefik.tcp.routers.router-inside-redis.service=frontend-inside-redis@docker"
      - "traefik.tcp.services.frontend-inside-redis.loadbalancer.server.port=6379"
        
  es-mt01:
    build: ./elasticsearch
    image: custom-elasticsearch
    restart: always
    container_name: es-mt01
    environment:
      - network.host=0.0.0.0
      - node.name=es-mt01
      - node.master=true
      - node.data=false
      - node.ingest=false
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt02,es-mt03
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms4g -Xmx4g"
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/master01/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/master01:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-mt01.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-mt01.entrypoints=entrypoint-mt01"
      - "traefik.http.routers.router-mt01.service=frontend-mt01@docker"
      - "traefik.http.services.frontend-mt01.loadbalancer.server.port=9200"

  es-mt02:
    build: ./elasticsearch
    image: custom-elasticsearch
    restart: always
    container_name: es-mt02
    environment:
      - network.host=0.0.0.0
      - node.name=es-mt02
      - node.master=true
      - node.data=false
      - node.ingest=false
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt01,es-mt03
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms4g -Xmx4g"
      #- xpack.security.transport.ssl.enabled=true
      #- xpack.security.enabled=true
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/master02/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/master02:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-mt02.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-mt02.entrypoints=entrypoint-mt02"
      - "traefik.http.routers.router-mt02.service=frontend-mt02@docker"
      - "traefik.http.services.frontend-mt02.loadbalancer.server.port=9200"

  es-mt03:
    build: ./elasticsearch
    image: custom-elasticsearch
    restart: always
    container_name: es-mt03
    environment:
      - network.host=0.0.0.0
      - node.name=es-mt03
      - node.master=true
      - node.data=false
      - node.ingest=false
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt01,es-mt02
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms4g -Xmx4g"
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/master03/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/master03:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-mt03.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-mt03.entrypoints=entrypoint-mt03"
      - "traefik.http.routers.router-mt03.service=frontend-mt03@docker"
      - "traefik.http.services.frontend-mt03.loadbalancer.server.port=9200"

  es-cdn01:
    build: ./elasticsearch
    image: custom-elasticsearch
    restart: always
    container_name: es-cdn01
    environment:
      - network.host=0.0.0.0
      - node.name=es-cdn01
      - node.master=false
      - node.data=false
      - node.ingest=false
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt01,es-mt02,es-mt03
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/coordinate01/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/coordinate01:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-cdn01.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-cdn01.entrypoints=entrypoint-cdn01"
      - "traefik.http.routers.router-cdn01.service=frontend-cdn01@docker"
      - "traefik.http.services.frontend-cdn01.loadbalancer.server.port=9200"

  es-cdn02:
    build: ./elasticsearch
    image: custom-elasticsearch
    restart: always
    container_name: es-cdn02
    environment:
      - network.host=0.0.0.0
      - node.name=es-cdn02
      - node.master=false
      - node.data=false
      - node.ingest=false
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt01,es-mt02,es-mt03
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/coordinate02/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/coordinate02:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-cdn02.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-cdn02.entrypoints=entrypoint-cdn02"
      - "traefik.http.routers.router-cdn02.service=frontend-cdn02@docker"
      - "traefik.http.services.frontend-cdn02.loadbalancer.server.port=9200"

  es-data01:
    build: ./elasticsearch
    image: custom-elasticsearch
    restart: always
    container_name: es-data01
    environment:
      - network.host=0.0.0.0
      - node.name=es-data01
      - node.master=false
      - node.data=true
      - node.ingest=false
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt01,es-mt02,es-mt03
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms4g -Xmx4g"
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/data01/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/data01:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-data01.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-data01.entrypoints=entrypoint-data01"
      - "traefik.http.routers.router-data01.service=frontend-data01@docker"
      - "traefik.http.services.frontend-data01.loadbalancer.server.port=9200"

  es-data02:
    build: ./elasticsearch
    image: custom-elasticsearch
    restart: always
    container_name: es-data02
    environment:
      - network.host=0.0.0.0
      - node.name=es-data02
      - node.master=false
      - node.data=true
      - node.ingest=false
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt01,es-mt02,es-mt03
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms4g -Xmx4g"
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/data02/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/data02:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-data02.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-data02.entrypoints=entrypoint-data02"
      - "traefik.http.routers.router-data02.service=frontend-data02@docker"
      - "traefik.http.services.frontend-data02.loadbalancer.server.port=9200"

  es-data03:
    build: ./elasticsearch
    image: custom-elasticsearch
    restart: always
    container_name: es-data03
    environment:
      - network.host=0.0.0.0
      - node.name=es-data03
      - node.master=false
      - node.data=true
      - node.ingest=false
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt01,es-mt02,es-mt03
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms4g -Xmx4g"
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/data03/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/data03:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-data03.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-data03.entrypoints=entrypoint-data03"
      - "traefik.http.routers.router-data03.service=frontend-data03@docker"
      - "traefik.http.services.frontend-data03.loadbalancer.server.port=9200"

  es-ing01:
    build: ./elasticsearch
    image: custom-elasticsearch
    container_name: es-ing01
    restart: always
    environment:
      - network.host=0.0.0.0
      - node.name=es-ing01
      - node.master=false
      - node.data=false
      - node.ingest=true
      - cluster.remote.connect=false
      - cluster.name=nanoit-log-cluster
      - discovery.seed_hosts=es-mt01,es-mt02,es-mt03
      - cluster.initial_master_nodes=es-mt01,es-mt02,es-mt03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
      - xpack.monitoring.enabled=true
      - xpack.monitoring.collection.enabled=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/elasticsearch/ingest01/:/usr/share/elasticsearch/data
      - /home/operation/data/logs/elasticsearch/ingest01:/usr/share/elasticsearch/logs
      - ./elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties
    networks:
      - elastic-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-ing01.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-ing01.entrypoints=entrypoint-ing01"
      - "traefik.http.routers.router-ing01.service=frontend-ing01@docker"
      - "traefik.http.services.frontend-ing01.loadbalancer.server.port=9200"

  es-kib:
    build: ./kibana
    image: custom-kibana
    container_name: es-kib
    restart: always
    networks:
      - elastic-network
    depends_on: ['es-mt01', 'es-mt02', 'es-mt03', 'es-cdn01', 'es-cdn02', 'es-data01', 'es-data02', 'es-data03']
    environment:
      ELASTICSEARCH_HOSTS: '["http://es-mt01:9200","http://es-mt02:9200","http://es-mt03:9200","http://es-cdn01:9200","http://es-cdn02:9200","http://es-data01:9200","http://es-data02:9200","http://es-data03:9200","http://es-ing01:9200"]'
      NODE_OPTIONS: "--max-old-space-size=2048"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/operation/data/logs/elasticsearch/kibana01:/usr/share/kibana/log
      - /home/operation/data/htpasswd/userfile:/userfile
      - ./kibana/kibana.yml:/usr/share/kibana/config/kibana.yml
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=elastic-network"

      - "traefik.http.routers.secured-kibana.rule=Host(`${HOSTURL}`)"
      - "traefik.http.routers.secured-kibana.entrypoints=entrypoint-https"
      - "traefik.http.routers.secured-kibana.service=dashboard-kibana@docker"
      - "traefik.http.routers.secured-kibana.tls=true"
      - "traefik.http.routers.secured-kibana.tls.certresolver=nanoit-cert"
      - "traefik.http.routers.secured-kibana.middlewares=basicauth@docker"
      - "traefik.http.middlewares.basicauth.basicauth.usersfile=/userfile"
      - "traefik.http.services.dashboard-kibana.loadbalancer.server.port=5601"

      - "traefik.http.routers.inside-kibana.rule=Host(`{any:.*}`)"
      - "traefik.http.routers.inside-kibana.entrypoints=entrypoint-kibana"
      - "traefik.http.routers.inside-kibana.service=dashboard-inside-kibana@docker"
      - "traefik.http.services.dashboard-inside-kibana.loadbalancer.server.port=5601"
   
  es-idx:
    build: ./logstash
    image: custom-logstash
    container_name: es-idx
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./logstash/config/:/usr/share/logstash/config/
      - /home/operation/data/elasticsearch/logstash-idx01:/usr/share/logstash/data
      - /home/operation/data/logs/elasticsearch/logstash01:/usr/share/logstash/logs
      - ./ssl:/usr/share/logstash/ssl
    environment:
      LS_JAVA_OPTS: "-Xmx1024m -Xms1024m"
    networks:
      - elastic-network
    restart: always
    depends_on: ['es-mt01', 'es-mt02', 'es-mt03', 'es-cdn01', 'es-cdn02', 'es-data01', 'es-data02', 'es-data03', 'es-kib']
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.router-idx.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.router-idx.entrypoints=entrypoint-idx"
      - "traefik.http.routers.router-idx.service=frontend-idx@docker"
      - "traefik.http.services.frontend-idx.loadbalancer.server.port=9600"

  es-mtb01:
    build: ./host-metricbeat
    image: custom-metricbeat-host
    container_name: es-mtb01
    command: ["--strict.perms=false"]
    user: root
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /proc:/hostfs/proc:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /:/hostfs:ro
      - /home/operation/data/logs/elasticsearch/metricbeat01:/usr/share/metricbeat/logs
      - /home/operation/data/elasticsearch/metricbeat01/:/usr/share/metricbeat/data
      - /home/operation/app/elk-docker-compose/host-metricbeat/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
    network_mode: host
    restart: always
    depends_on: ['es-mt01', 'es-mt02', 'es-mt03', 'es-cdn01', 'es-cdn02', 'es-data01', 'es-data02', 'es-kib', 'es-idx', 'es-data03']
    cap_add:
      - sys_ptrace
      - dac_read_search

  es-mtb02:
    build: ./container-metricbeat
    image: custom-metricbeat-container
    container_name: es-mtb02
    command: ["--strict.perms=false"]
    user: root
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /proc:/hostfs/proc:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /:/hostfs:ro
      - /home/operation/data/logs/elasticsearch/metricbeat02:/usr/share/metricbeat/logs
      - /home/operation/data/elasticsearch/metricbeat02/:/usr/share/metricbeat/data
      - /home/operation/app/elk-docker-compose/container-metricbeat/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
    networks:
      - elastic-network
    restart: always
    depends_on: ['es-mt01', 'es-mt02', 'es-mt03', 'es-cdn01', 'es-cdn02', 'es-data01', 'es-data02', 'es-kib', 'es-idx', 'es-data03']
    cap_add:
      - sys_ptrace
      - dac_read_search

  es-htb:
    build: ./heartbeat
    image: custom-heartbeat
    container_name: es-htb
    command: ["--strict.perms=false"]
    user: root
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./heartbeat/heartbeat.yml:/usr/share/heartbeat/heartbeat.yml
      - /home/operation/data/elasticsearch/heartbeat01/:/usr/share/heartbeat/data
      - /home/operation/data/logs/elasticsearch/heartbeat01:/usr/share/heartbeat/logs
      - ./ssl:/usr/share/heartbeat/ssl
    networks:
      - elastic-network
    restart: always
    depends_on: ['es-mt01', 'es-mt02', 'es-mt03', 'es-cdn01', 'es-cdn02', 'es-data01', 'es-data02', 'es-kib', 'es-idx', 'es-data03']

  es-ftb:
    build: ./filebeat
    image: custom-filebeats
    container_name: es-ftb
    command: ["--strict.perms=false"]
    user: root
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/log:/usr/share/filebeat/logs/system

      - ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml
      - /home/operation/data/elasticsearch/filebeat01/:/usr/share/filebeat/data

      - /home/operation/data/logs/elasticsearch:/usr/share/filebeat/logs/elasticsearch
      - /home/operation/data/logs/traefik:/usr/share/filebeat/logs/traefik
      - /home/operation/data/redis:/usr/share/filebeat/logs/redis
      - ./ssl:/usr/share/filebeat/ssl
    networks:
      - elastic-network
    restart: always
    depends_on: ['es-mt01', 'es-mt02', 'es-mt03', 'es-cdn01', 'es-cdn02', 'es-data01', 'es-data02', 'es-kib', 'es-idx', 'es-data03', 'es-redis']

networks:
  elastic-network:
    external: true

reference