Docker ELK-Stack Container - Logstash-Forwarder

maintained by MarvAmBass

FAQ - All you need to know about the marvambass Containers

What is it

This Dockerfile (available as marvambass/logstash-forwarder) gives you a ready to use Logstash-Forwarder Container for your ELK stack or something else.

View in Docker Registry marvambass/logstash-forwarder

View in GitHub MarvAmBass/docker-logstash-forwarder

Environment variables and defaults

Variables

• LOGSTASH_SERVER
• default: logstash:5000
• you should set this to the common name and port of your logstash server

Cert Filenames

• /certs/logstash-forwarder.crt
• this must be the same cert file used by logstash!

Running marvambass/logstash-forwarder Container

First of all you could start my elasticsearch container (Kibana needs a Elasticsearch instance to work) like this:

docker run -d \
--name elasticsearch \
-v "$PWD/esdata":/usr/share/elasticsearch/data
marvambass/elasticsearch

Secondly the Logstash Container:

docker run -d \
--name logstash \
--link elasticsearch:elasticsearch \
-v "$PWD/conf:/conf" \
-v "$PWD/certs:/certs" \
marvambass/logstash

_we create a new container and link it to our elasticsearch instance by the name elasticsearch, we also overwrite the /conf directory with our own configuration directory and the /certs directory to use our certs.

Now the Logstash-Forwarder Container which forwards the logs into Logstash:

docker run -d \
--name logstash-forwarder \
--link logstash:logstash \
--volumes-from logstash \
-v "$PWD/logstash-forwarder-conf:/logstash-forwarder-conf" \
-v /var/log:/var/log:ro marvambass/logstash-forwarder

we create a new container and link it to our logstash server (you could also set LOGSTASH_SERVER variable to point to a public server). after that we add our ssl certificate, the logstash forwarder config and the directory with the logfiles in it

Based on

This Dockerfile is based on my marvambass/oracle-java8 Image.