root@ubuntu:~/stack-docker# cat docker-compose.yml
---
version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-platinum:${TAG}
    container_name: elasticsearch
    network_mode: host
    environment: ['http.host=0.0.0.0', 'transport.host=127.0.0.1', 'ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    environment:
      ES_JAVA_OPTS: "-Xmx4g -Xms4g"

    ports: ['127.0.0.1:9200:9200']

  kibana:
    image: docker.elastic.co/kibana/kibana:${TAG}
    container_name: kibana
    environment:
      - ELASTICSEARCH_USERNAME=kibana
      - ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD}
    network_mode: host
    ports: ['127.0.0.1:5601:5601']
    depends_on: ['elasticsearch']

  logstash:
    image: docker.elastic.co/logstash/logstash:${TAG}
    container_name: logstash
    network_mode: host
    environment:
      - 'xpack.monitoring.elasticsearch.password=${ELASTIC_PASSWORD}'
    # Provide a simple pipeline configuration for Logstash with a bind-mounted file.
    volumes:
      - ./config/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    depends_on: ['elasticsearch', 'setup_logstash']

  auditbeat:
    image: docker.elastic.co/beats/auditbeat:${TAG}
    container_name: auditbeat
    command: -e -E 'output.elasticsearch.password=${ELASTIC_PASSWORD}'
    cap_add: ['AUDIT_CONTROL', 'AUDIT_READ']
    # Auditbeat must run in the main process namespace.
    pid: host
    network_mode: host
    depends_on: ['elasticsearch']

  filebeat:
    image: docker.elastic.co/beats/filebeat:${TAG}
    container_name: filebeat
    command: -e -E 'output.elasticsearch.password=${ELASTIC_PASSWORD}'
    # If the host system has logs at "/var/log", mount them at "/mnt/log"
    # inside the container, where Filebeat can find them.
    # volumes: ['/var/log:/mnt/log:ro']
    network_mode: host
    depends_on: ['elasticsearch', 'setup_filebeat']

  heartbeat:
    image: docker.elastic.co/beats/heartbeat:${TAG}
    container_name: heartbeat
    command: -e -E 'output.elasticsearch.password=${ELASTIC_PASSWORD}'
    network_mode: host
    depends_on: ['elasticsearch', 'setup_heartbeat']

  metricbeat:
    image: docker.elastic.co/beats/metricbeat:${TAG}
    container_name: metricbeat
    # The commented sections below enable Metricbeat to monitor the Docker host,
    # rather than the Metricbeat container. It's problematic with Docker for
    # Windows, however, since "/proc", "/sys" etc. don't exist on Windows.
    # The same likely applies to OSX (needs testing).
    # volumes:
    #   - /proc:/hostfs/proc:ro
    #   - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
    #   - /:/hostfs:ro
    command: -e -E 'output.elasticsearch.password=${ELASTIC_PASSWORD}' # -system.hostfs=/hostfs
    network_mode: host
    depends_on: ['elasticsearch', 'setup_metricbeat']

  packetbeat:
    image: docker.elastic.co/beats/packetbeat:${TAG}
    container_name: packetbeat
    # Packetbeat needs some elevated privileges to capture network traffic.
    # We'll grant them with POSIX capabilities.
    cap_add: ['NET_RAW', 'NET_ADMIN']
    # Use "host mode" networking to allow Packetbeat to capture traffic from
    # the real network interface on the host, rather than being isolated to the
    # container's virtual interface.
    network_mode: host
    # Since we did that, Packetbeat is not part of the "stack" Docker network
    # that the other containers are connected to, and thus can't resolve the
    # hostname "elasticsearch". Instead, we'll tell it to find Elasticsearch
    # on "localhost", which is the Docker host machine in this context.
    command: -e -E 'output.elasticsearch.hosts=["localhost:9200"]' -E 'output.elasticsearch.password=${ELASTIC_PASSWORD}'
    depends_on: ['elasticsearch']

  apm_server:
    image: docker.elastic.co/apm/apm-server:${TAG}
    container_name: apm_server
    ports: ['127.0.0.1:8200:8200']
    network_mode: host
    command: -e -E 'output.elasticsearch.password=${ELASTIC_PASSWORD}'
    depends_on: ['elasticsearch','setup_apm_server']

  # Run a short-lived container to set up Logstash.
  setup_logstash:
    image: centos:7
    container_name: setup_logstash
    volumes: ['./scripts/setup-logstash.sh:/usr/local/bin/setup-logstash.sh:ro']
    # The script may have CR/LF line endings if using Docker for Windows, so
    # make sure that they don't confuse Bash.
    command: ['/bin/bash', '-c', 'cat /usr/local/bin/setup-logstash.sh | tr -d "\r" | bash']
    environment: ['ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    network_mode: host
    depends_on: ['elasticsearch']

  setup_kibana:
    image: centos:7
    container_name: setup_kibana
    volumes: ['./scripts/setup-kibana.sh:/usr/local/bin/setup-kibana.sh:ro']
    command: ['/bin/bash', '-c', 'cat /usr/local/bin/setup-kibana.sh | tr -d "\r" | bash']
    environment: ['ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    network_mode: host
    depends_on: ['elasticsearch']

  setup_auditbeat:
    image: docker.elastic.co/beats/auditbeat:${TAG}
    container_name: setup_auditbeat
    volumes: ['./scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro']
    command: ['/bin/bash', '-c', 'cat /usr/local/bin/setup-beat.sh | tr -d "\r" | bash -s auditbeat']
    environment: ['ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    network_mode: host
    depends_on: ['kibana']

  setup_filebeat:
    image: docker.elastic.co/beats/filebeat:${TAG}
    container_name: setup_filebeat
    volumes: ['./scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro']
    command: ['/bin/bash', '-c', 'cat /usr/local/bin/setup-beat.sh | tr -d "\r" | bash -s filebeat']
    environment: ['ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    network_mode: host
    depends_on: ['kibana']

  setup_heartbeat:
    image: docker.elastic.co/beats/heartbeat:${TAG}
    container_name: setup_heartbeat
    volumes: ['./scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro']
    command: ['/bin/bash', '-c', 'cat /usr/local/bin/setup-beat.sh | tr -d "\r" | bash -s heartbeat']
    environment: ['ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    network_mode: host
    depends_on: ['kibana']

  setup_metricbeat:
    image: docker.elastic.co/beats/metricbeat:${TAG}
    container_name: setup_metricbeat
    volumes: ['./scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro']
    command: ['/bin/bash', '-c', 'cat /usr/local/bin/setup-beat.sh | tr -d "\r" | bash -s metricbeat']
    environment: ['ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    network_mode: host
    depends_on: ['kibana']

  setup_packetbeat:
    image: docker.elastic.co/beats/packetbeat:${TAG}
    container_name: setup_packetbeat
    cap_add: ['NET_RAW', 'NET_ADMIN']
    volumes: ['./scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro']
    command: ['/bin/bash', '-c', 'cat /usr/local/bin/setup-beat.sh | tr -d "\r" | bash -s packetbeat']
    environment: ['ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    network_mode: host
    depends_on: ['kibana']

  setup_apm_server:
    image: docker.elastic.co/apm/apm-server:${TAG}
    container_name: setup_apm_server
    volumes: ['./scripts/setup-beat.sh:/usr/local/bin/setup-beat.sh:ro']
    command: ['/bin/bash', '-c', 'cat /usr/local/bin/setup-beat.sh | tr -d "\r" | bash -s apm-server']
    environment: ['ELASTIC_PASSWORD=${ELASTIC_PASSWORD}']
    network_mode: host
    depends_on: ['elasticsearch','kibana']