Deploy an ELK Stack Quickly with Docker Compose

ELK Stack Overview

ELK (Elasticsearch, Logstash, Kibana) is an open‑source log collection platform that aggregates client logs for analysis on a single platform.

Introduction

Elasticsearch – JSON‑based search engine.

Logstash – dynamic data collection pipeline.

Kibana – visualizes data collected by Elasticsearch.

Background

Initially ELK was installed via RPM or repository on each server, which required repeated setup for every new instance. To reduce this effort, the article shows how to launch ELK quickly with Docker, avoiding manual installation.

Prerequisite

1. Clone the Git repository (branch: master) into a directory under the user’s home, e.g., /home/user1/.

2. Choose configuration environment variables according to deployment needs:

All components on one machine – edit ~/elasticstack/.env.

Separate machines – edit individual files:

The .env files contain basic settings such as environment (qa/prod), E_LOCAL_DATA_PATH for Elasticsearch data storage, L_ELASTICSEARCH_HOST_ENV and K_ELASTICSEARCH_HOST_IP to define host connections when components run on the same or different machines.

Start ELK with Docker‑Compose

After configuring the .env files, run docker-compose up -d in ~/elasticstack. The provided docker-compose.yml passes the environment variables to the containers; you may adjust container properties if needed.

The Docker images are built from custom Dockerfiles located at:

Elasticsearch: ~/elasticstack/elasticsearch/Dockerfile Logstash: ~/elasticstack/logstash/Dockerfile Kibana: ~/elasticstack/kibana/Dockerfile Two deployment options are illustrated:

Single‑host deployment – use ~/elasticstack/docker-compose.yml.

Multi‑host deployment – separate compose files for each component (Elasticsearch, Logstash, Kibana) on different machines.

Verify the Deployment

Access Kibana at <kibana_host>:5601. A successful start shows the Kibana UI; initial messages like “Unable to fetch mapping…” are expected until logs are sent via Beats plugins.