Skip to content
Docker image for centralized logging based on CentOS 7 with rsyslog, elasticsearch and kibana.
Ruby Shell
Branch: master
Clone or download
Peter Schiffer
Peter Schiffer Updated kibana to 4.1.1
Latest commit 9c4508b Aug 20, 2015
Type Name Latest commit message Commit time
Failed to load latest commit information.
doc/images Added screenshots May 6, 2015
elasticsearch Updated elasticsearch to 1.7.x Aug 20, 2015
kibana Updated SSSD visualizations May 6, 2015
rsyslog Fixed rsyslog rules for audit log Apr 20, 2015
supervisor Disabled receiving of syslog messages via local socket Apr 14, 2015
Dockerfile Updated kibana to 4.1.1 Aug 20, 2015
LICENSE Initial commit Mar 17, 2015 Updated doc Jun 8, 2015


Docker image for centralized logging based on CentOS 7 with rsyslog, elasticsearch and kibana.

Contains several pre-configured dashboards for freeIPA server - User Logins, IPA Server Administration, IPA Server Health, IPA Server Utilization and SSSD. Screencast is available on youtube. For more information about this effort and how to configure FreeIPA servers and clients to send proper logs to this container, visit this page.

To get this image, pull it from docker hub:

$ docker pull pschiffe/rsyslog-elasticsearch-kibana

Or, if you want to build this image yourself, clone the github repo and in directory with Dockerfile run:

$ docker build -t <username>/rsyslog-elasticsearch-kibana .

To run the image use:

$ docker run -d -p 514:514 -p 514:514/udp -p 5601:5601 -v /etc/localtime:/etc/localtime:ro pschiffe/rsyslog-elasticsearch-kibana

Rsyslog listens on standard port 514 (both TCP and UDP) and kibana on TCP port 5601. To forward log messages from your system, configure rsyslog according to this recipe with appropriate address of running container. To test the running container from the host system you can use:

$ logger -n localhost 'log message from host'

Kibana is available via regular web browser on http://localhost:5601 address from the host system. Please note, that it can take up to 10 seconds for container to be ready after start.

Elasticsearch is storing data in docker data volume /var/lib/elasticsearch.

You can’t perform that action at this time.