[opensourcedex]

elastdocker is a free, open source monitoring & observability project written in Dockerfile and released under MIT. It has 2,066 GitHub stars, 338 forks and 4 open issues, and was last pushed 2 months ago. On this registry it ranks #169 of 271 tracked projects in Monitoring & Observability, with 5 head-to-head comparisons available.

What is elastdocker?

elastdocker is a Docker Compose composition that runs the Elastic Stack (ELK) version 9.4.2 — Elasticsearch, Kibana, Logstash, Beats, and the supporting components — preconfigured with security, self-monitoring, and tooling for logging, metrics, APM, alerting, machine learning, and SIEM, aimed at developers and small teams who want the full stack running with a single command instead of wiring it together by hand.

What it is

elastdocker lives in the Docker and docker-compose ecosystem. It is a Compose template built on the official Elastic Docker images from docker.elastic.co, and it covers the whole Elastic Stack: Elasticsearch, Kibana, Logstash, Filebeat, Metricbeat, and Prometheus exporters. The stack version is set through the ELK_VERSION variable in the .env file, and the template supports any version of 9.0.0 or later. Configuration — credentials, heap size, and other stack parameters — is driven from .env rather than being hardcoded into individual component configs. It ships as a single-node production cluster by default, with a multi-node option provided for experimentation.

The concrete problem it solves is the setup work that normally stands between a fresh Docker host and a usable Elastic Stack. Security is enabled by default, which means TLS on the transport layer, initial master node settings, and generated SSL certificates and an Elasticsearch keystore that persist across container recreation. Credentials are parameterized instead of hardcoded as elastic:changeme in every component config, and recommended host settings such as ulimits and swap disable are already present in the Compose file. In practice it is a direct replacement for hand-assembling an ELK Compose file, and it positions itself as an alternative to deviantony/docker-elk.

Key capabilities

  • Enablement of logging and metrics ingestion, APM, alerting, machine learning with anomaly detection, and SIEM use cases out of the box.
  • Collect logs from every Docker container on the host with mise run collect-docker-logs; Filebeat discovers containers, parses logs, and ships them to Elasticsearch.
  • Security enabled by default under the Basic license rather than the Trial license, including transport-layer SSL and initial master node settings.
  • Persistence of the Elasticsearch keystore and SSL certificates, with an extendable script that recreates the keystore whenever a container is created.
  • Self-monitoring metrics for Elasticsearch 9 and above using Metricbeat, plus Prometheus exporters for stack metrics and embedded container healthchecks.
  • Production-oriented environment settings in Docker Compose, including ulimits and swap disable.
  • Full stack parameterization through .env and a set of mise tasks that wrap the underlying Docker Compose commands.

Who uses it and how

  • Teams running demos, MVPs, and small production deployments that need logging and observability quickly without building bespoke configuration.
  • Operators on Windows and macOS, who must ensure the Docker VM has more than 4GB of memory, the stated minimum requirement.
  • Linux Docker hosts, which need sysctl -w vm.max_map_count=262144 run as root because the default virtual memory setting is not sufficient for Elasticsearch.
  • Security and observability groups that want SIEM, APM, and alerting available from the same deployment.
  • Teams extending a single-node deployment into a multi-node cluster, since the template is built to be extended for that purpose.

Getting started

Setup starts by cloning the repository, then running mise run stack:setup to initialize the Elasticsearch keystore and TLS self-signed certificates, followed by mise run up (equivalent to docker compose up -d). Kibana is then reachable at https://localhost:5601 with the default username elastic and password changeme, which should be changed in .env.

How it compares

Among similar tools, the README names deviantony/docker-elk as the most popular ELK-on-Docker repository and defines itself against it. The differences it claims are security enabled by default under the Basic license rather than the Trial license, data persisted to a volume by default, production mode with SSL on the transport layer, credentials and other settings parameterized in .env, and configured self-monitoring and Prometheus exporters.

When to use it — and when not to

A self-hoster takes on operation of the Docker Compose stack, the Elasticsearch keystore and generated certificates, host kernel tuning on Linux, and at least 4GB of memory. Anyone who wants a fully managed, hosted observability service, or who does not want to administer Elasticsearch and Kibana themselves, should not pick this. The project is also clone-and-configure rather than a published package or image, so upgrades move with the repository, and the README warns that moving from 8.x to 9.x carries breaking changes and migration steps.

project readme (upstream, from github) — read inline

Elastic Stack on Docker

Preconfigured Security, Tools, and Self-Monitoring

Configured to be ready to be used for Log, Metrics, APM, Alerting, Machine Learning, and Security (SIEM) usecases.

Elastic Stack Version 9^^ contributions welcome GitHub forks GitHub issues GitHub license

Introduction

Elastic Stack (ELK) Docker Composition, preconfigured with Security, Monitoring, and Tools; Up with a Single Command.

Suitable for Demoing, MVPs and small production deployments.

Stack Version: 9.4.2 🎉 - Based on Official Elastic Docker Images

You can change Elastic Stack version by setting ELK_VERSION in .env file and rebuild your images. Any version >= 9.0.0 is compatible with this template.

⚠️ Upgrading from 8.x? See the Upgrade Notes section below for breaking changes and migration steps.

Main Features 📜

  • Configured as a Production Single Node Cluster. (With a multi-node cluster option for experimenting).
  • Security Enabled By Default.
  • Configured to Enable:
    • Logging & Metrics Ingestion
      • Option to collect logs of all Docker Containers running on the host. via mise run collect-docker-logs.
    • APM
    • Alerting
    • Machine Learning
    • Anomaly Detection
    • SIEM (Security information and event management).
    • Enabling Trial License
  • Use Docker Compose and .env to configure your entire stack parameters.
  • Persist Elasticsearch's Keystore and SSL Certifications.
  • Self-Monitoring Metrics Enabled (using Metricbeat for ES 9+).
  • Prometheus Exporters for Stack Metrics.
  • Embedded Container Healthchecks for Stack Images.

More points

And comparing Elastdocker and the popular deviantony/docker-elk

Expand...

One of the most popular ELK on Docker repositories is the awesome deviantony/docker-elk. Elastdocker differs from deviantony/docker-elk in the following points.

  • Security enabled by default using Basic license, not Trial.

  • Persisting data by default in a volume.

  • Run in Production Mode (by enabling SSL on Transport Layer, and add initial master node settings).

  • Persisting Generated Keystore, and create an extendable script that makes it easier to recreate it every-time the container is created.

  • Parameterize credentials in .env instead of hardcoding elastich:changeme in every component config.

  • Parameterize all other Config like Heap Size.

  • Add recommended environment configurations as Ulimits and Swap disable to Docker Compose.

  • Make it ready to be extended into a multinode cluster.

  • Configuring the Self-Monitoring and the Filebeat agent that ship ELK logs to ELK itself. (as a step to shipping it to a monitoring cluster in the future).

  • Configured Prometheus Exporters.

  • The Makefile that simplifies everything into some simple commands.

Automatic Docker Container Log Collection

Collect logs from all Docker containers on your host with a single command:

mise run collect-docker-logs

Filebeat automatically discovers containers, parses logs, and ships them to Elasticsearch. View and analyze everything in Kibana with zero configuration.

Requirements

  • Docker 20.05 or higher with Docker Compose v2
  • 4GB RAM (For Windows and MacOS make sure Docker's VM has more than 4GB+ memory.)

Setup

  1. Clone the Repository

    git clone https://github.com/sherifabdlnaby/elastdocker.git

  2. Initialize Elasticsearch Keystore and TLS Self-Signed Certificates

    mise run stack:setup

    For Linux's docker hosts only. By default virtual memory is not enough so run the next command as root sysctl -w vm.max_map_count=262144

  3. Start Elastic Stack

    mise run up        #   docker compose up -d

  4. Visit Kibana at https://localhost:5601 or https://:5601

    Default Username: elastic, Password: changeme

    • Notice that Kibana is configured to use HTTPS, so you'll need to write https:// before localhost:5601 in the browser.
    • Modify .env file for your needs, most importantly ELASTIC_PASSWORD that setup your superuser elastic's password, ELASTICSEARCH_HEAP & LOGSTASH_HEAP for Elasticsearch & Logstash Heap Size.

Whatever your Host (e.g AWS EC2, Azure, DigitalOcean, or on-premise server), once you expose your host to the network, ELK component will be accessible on their respective ports. Since the enabled TLS uses a self-signed certificate, it is recommended to SSL-Terminate public traffic using your signed certificates.

🏃🏻‍♂️ To start ingesting logs, you can start by running mise run collect-docker-logs which will collect your host's container logs.

Additional Commands

Expand

To Start Monitoring and Prometheus Exporters
mise run monitoring
To Ship Docker Container Logs to ELK
mise run collect-docker-logs
To Start Elastic Stack, Tools and Monitoring
mise run all
To Start 2 Extra Elasticsearch nodes (recommended for experimenting only)
mise run nodes
To Rebuild Images
mise run build
Bring down the stack
mise run down
Reset everything, Remove all containers, and delete DATA
mise run prune

Configuration

  • Some Configuration are parameterized in the .env file.
    • ELASTIC_PASSWORD, user elastic's password (default: changeme pls).
    • ELK_VERSION Elastic Stack Version (default: 9.4.2)
    • ELASTICSEARCH_HEAP, how much Elasticsearch allocate from memory (default: 1GB -good for development only-)
    • LOGSTASH_HEAP, how much Logstash allocate from memory.
    • Other configurations which their such as cluster name, and node name, etc.
  • Elasticsearch Configuration in elasticsearch.yml at ./elasticsearch/config.
  • Logstash Configuration in logstash.yml at ./logstash/config/logstash.yml.
  • Logstash Pipeline in main.conf at ./logstash/pipeline/main.conf.
  • Kibana Configuration in kibana.yml at ./kibana/config.
  • Metricbeat Configuration in metricbeat.yml at ./metricbeat/config (for Stack Monitoring in ES 9+).

Setting Up Keystore

You can extend the Keystore generation script by adding keys to ./setup/keystore.sh script. (e.g Add S3 Snapshot Repository Credentials)

To Re-generate Keystore:

mise run keystore
Notes

  • ⚠️ Elasticsearch HTTP layer is using SSL, thus mean you need to configure your elasticsearch clients with the CA in secrets/certs/ca/ca.crt, or configure client to ignore SSL Certificate Verification (e.g --insecure in curl).

  • Adding Two Extra Nodes to the cluster will make the cluster depending on them and won't start without them again.

  • The stack is driven by mise tasks; run mise tasks to list them. The Makefile keeps the same commands but is deprecated.

  • Elasticsearch will save its data to a volume named elasticsearch-data

  • Elasticsearch Keystore (that contains passwords and credentials) and SSL Certificate are generated in the ./secrets directory by the setup command.

  • Make sure to run mise run stack:setup if you changed ELASTIC_PASSWORD and to re

readme truncated — read the full docs on github

Frequently asked questions

Is elastdocker free to use?

elastdocker is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does elastdocker do?

🐳 Elastic Stack (ELK) v9+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Si

What is elastdocker written in?

elastdocker is primarily written in Dockerfile. Its source is publicly available at https://github.com/sherifabdlnaby/elastdocker, and it has 2,066 GitHub stars.