This repository is contains Docker Stack composition for ELK Stack
ELK consists of three independent products:
• Elasticsearch is a distributed, JSON-based search and analytics engine, that allows us to store the data and search
• Logstash is a server-side data processing pipeline that gather data, transforms it, and then sends it to Elasticsearch
• Kibana used to visualize Elasticsearch data and navigate the Elastic Stack
| Port | Description |
|---|---|
| 4560 | Syslog Logstash Listener |
| 5044 | Beats Listener |
| 5601 | Kibana Web |
| 9200 | Elasticsearch REST |
| 9300 | Elasticsearch Internal |
<custom-handler name="SYSLOG" class="org.jboss.logmanager.handlers.SyslogHandler" module="org.jboss.logmanager">
<encoding value="UTF-8"/>
<formatter>
<pattern-formatter pattern="%-5p %s%E%n"/>
</formatter>
<properties>
<property name="appName" value="<application name>"/>
<property name="facility" value="SYSLOGD"/>
<property name="serverHostname" value="<logstash host>"/>
<property name="port" value="<logstash port>"/>
<property name="protocol" value="TCP"/>
<property name="hostname" value="<host name>"/>
<property name="maxLength" value="32768"/>
<property name="truncate" value="false"/>
<property name="syslogType" value="RFC5424"/>
</properties>
</custom-handler>