docker compose sample - nsano-rururu/elastalert-kibana-plugin GitHub Wiki

praecoapp/elastalert-server docker.elastic.co/kibana/kibana:7.7.0 docker.elastic.co/elasticsearch/elasticsearch:7.7.0

/home/sano/docker-wk2
|--Dockerfiles
|  |--Dockerfile-elastalert
|  |--Dockerfile-kibana
|--docker-compose.yml
|--elastalert
|  |--bin
|  |  |--elastalert-start.sh
|  |  |--elastic_search_status.sh
|  |--config
|  |  |--config.json
|  |  |--elastalert-test.yaml
|  |  |--elastalert.yaml
|  |--rule_templates
|  |--rules
|--es
|  |--config
|  |  |--elasticsearch.yml
|  |--data
|--kibana
|  |--config
|  |  |--kibana.yml

Dockerfiles/Dockerfile-elastalert

FROM praecoapp/elastalert-server

USER root

RUN apk update && \
    apk add bash curl && \
    rm -rf /var/cache/apk/*

ADD elastalert/bin/elastalert-start.sh /usr/local/bin/
ADD elastalert/bin/elastic_search_status.sh /usr/local/bin/

RUN chmod +x /usr/local/bin/elastalert-start.sh & \
    chmod +x /usr/local/bin/elastic_search_status.sh

USER node

ENTRYPOINT ["/usr/local/bin/elastalert-start.sh"]

Dockerfiles/Dockerfile-kibana

FROM docker.elastic.co/kibana/kibana:7.7.0

USER root

RUN /usr/share/kibana/bin/kibana-plugin install https://github.com/nsano-rururu/elastalert-kibana-plugin/releases/download/1.2.0/elastalert-kibana-plugin-1.2.0-7.7.0.zip --allow-root

USER kibana

docker-compose.yml

version: "3.7"
services:
  elasticsearch:
    container_name: elasticsearch
    image: docker.elastic.co/elasticsearch/elasticsearch:7.7.0
    ports:
      - 9200:9200
      - 9300:9300
    environment:
      - ES_JAVA_OPTS=-Xms256m -Xmx256m
      - discovery.type=single-node
    restart: always
    volumes:
      - ./es/data:/usr/share/elasticsearch/data
      - ./es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
    healthcheck:
        test: ["CMD-SHELL", "curl -f http://localhost:9200 || exit 1"]
        interval: 30s
        timeout: 15s
        retries: 3
        start_period: 180s

  kibana:
    container_name: kibana
    image: kibana:7.7.0
    ports:
      - 5601:5601
    depends_on:
      - elasticsearch
    restart: always
    volumes:
      - ./kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml
      #- ./kibana/plugin:/usr/share/kibana/work
    healthcheck:
        test: ["CMD-SHELL", "curl -f http://localhost:5601/api/status || exit 1"]
        interval: 30s
        timeout: 15s
        retries: 3
        start_period: 200s

  elastalert:
    container_name: elastalert
    build:
      context: .
      dockerfile: Dockerfiles/Dockerfile-elastalert
    image: elastalert:3.0.0
    ports:
      - 3030:3030
      - 3333:3333
    depends_on:
      - elasticsearch
      - kibana
    restart: always
    volumes:
      - ./elastalert/config/elastalert.yaml:/opt/elastalert/config.yaml
      - ./elastalert/config/elastalert-test.yaml:/opt/elastalert/config-test.yaml
      - ./elastalert/config/config.json:/opt/elastalert-server/config/config.json
      - ./elastalert/rules:/opt/elastalert/rules
      - ./elastalert/rule_templates:/opt/elastalert/rule_templates
    healthcheck:
        test: ["CMD-SHELL", "curl -f http://localhost:3030 || exit 1"]
        interval: 30s
        timeout: 15s
        retries: 3
        start_period: 200s

elastalert/bin/elastalert-start.sh

#!/bin/bash

set -e

echo "Giving Elasticsearch at $ELASTICSEARCH_URL time to start..."

elastic_search_status.sh

echo "Starting ElastAlert!"
npm start

elastalert/bin/elastic_search_status.sh

#!/bin/bash

set -e

if [ $# -gt 0 ]; then
  ES_URL="$1"
elif [ -n $ELASTICSEARCH_URL ](/nsano-rururu/elastalert-kibana-plugin/wiki/--n-$ELASTICSEARCH_URL-); then
  ES_URL="$ELASTICSEARCH_URL"
elif [ -n $ES_HOST ](/nsano-rururu/elastalert-kibana-plugin/wiki/--n-$ES_HOST-) && [ -n $ES_PORT ](/nsano-rururu/elastalert-kibana-plugin/wiki/--n-$ES_PORT-); then
  ES_URL="http://$ES_HOST:$ES_PORT"
else
  ES_URL="http://elasticsearch:9200"
fi

until [ "$(curl -fsSL "$ES_URL/_cat/health?h=status" ](/nsano-rururu/elastalert-kibana-plugin/wiki/sed--r-'s/^[[:space:)+|[:space:]]+$//g')" =~ ^(yellow](/nsano-rururu/elastalert-kibana-plugin/wiki/green)$-); do
  # printf '+' >&2
  sleep 1
done

echo "Elasticsearch is up and healthy at "$ES_URL"" >&2

elastalert/config/config.json

{
    "appName": "elastalert-server",
    "port": 3030,
    "wsport": 3333,
    "elastalertPath": "/opt/elastalert",
    "verbose": false,
    "es_debug": false,
    "debug": false,
    "rulesPath": {
      "relative": true,
      "path": "/rules"
    },
    "templatesPath": {
      "relative": true,
      "path": "/rule_templates"
    },
    "es_host": "elasticsearch",
    "es_port": 9200,
    "writeback_index": "elastalert_status"
  }

elastalert/config/elastalert-test.yaml

{
    "appName": "elastalert-server",
    "port": 3030,
    "wsport": 3333,
    "elastalertPath": "/opt/elastalert",
    "verbose": false,
    "es_debug": false,
    "debug": false,
    "rulesPath": {
      "relative": true,
      "path": "/rules"
    },
    "templatesPath": {
      "relative": true,
      "path": "/rule_templates"
    },
    "es_host": "elasticsearch",
    "es_port": 9200,
    "writeback_index": "elastalert_status"
  }

elastalert/config/elastalert.yaml

# NOTE: This config is used when testing a rule

# The elasticsearch hostname for metadata writeback
# Note that every rule can have its own elasticsearch host
es_host: elasticsearch

# The elasticsearch port
es_port: 9200

# This is the folder that contains the rule yaml files
# Any .yaml file will be loaded as a rule
rules_folder: rules

# How often ElastAlert will query elasticsearch
# The unit can be anything from weeks to seconds
run_every:
  seconds: 5

# ElastAlert will buffer results from the most recent
# period of time, in case some log sources are not in real time
buffer_time:
  minutes: 1

# Optional URL prefix for elasticsearch
#es_url_prefix: elasticsearch

# Connect with TLS to elasticsearch
#use_ssl: True

# Verify TLS certificates
#verify_certs: True

# GET request with body is the default option for Elasticsearch.
# If it fails for some reason, you can pass 'GET', 'POST' or 'source'.
# See http://elasticsearch-py.readthedocs.io/en/master/connection.html?highlight=send_get_body_as#transport
# for details
#es_send_get_body_as: GET

# Option basic-auth username and password for elasticsearch
#es_username: someusername
#es_password: somepassword

# The index on es_host which is used for metadata storage
# This can be a unmapped index, but it is recommended that you run
# elastalert-create-index to set a mapping
writeback_index: elastalert_status

# If an alert fails for some reason, ElastAlert will retry
# sending the alert until this time period has elapsed
alert_time_limit:
  days: 2

es/config/elasticsearch.yml

cluster.name: "docker-cluster"
network.host: 0.0.0.0
discovery.zen.minimum_master_nodes: 1

kibana/config/kibana.yml

server.name: kibana
server.host: "0"
elasticsearch.hosts: http://elasticsearch:9200
xpack.monitoring.ui.container.elasticsearch.enabled: true

# elastalert-kibana-plugin
elastalert-kibana-plugin.serverHost: elastalert
elastalert-kibana-plugin.serverPort: 3030

execute

mkdir -p es/data
chmod 777 es/data
cd Dockerfiles/
docker build -t kibana:7.7.0 -f Dockerfile-kibana .
cd ..
docker-compose up -d