docker-compose.yml

version: '3.2'

services:
  elasticsearch:
    build:
      context: elasticsearch/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./elasticsearch/config/elasticsearch.yml
        target: /usr/share/elasticsearch/config/elasticsearch.yml
        read_only: true
      - type: volume
        source: elasticsearch
        target: /usr/share/elasticsearch/data
    ports:
      - "127.0.0.1:9200:9200"
      - "127.0.0.1:9300:9300"
    environment:
      ES_JAVA_OPTS: "-Xmx256m -Xms256m"
      ELASTIC_USERNAME: "elastic"
      ELASTIC_PASSWORD: $elasticsearch_password
      http.cors.enabled: "true"
      http.cors.allow-origin: "*"
      discovery.type: single-node
    networks:
      - elk

  kibana:
    build:
      context: kibana/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./kibana/config/kibana.yml
        target: /usr/share/kibana/config/kibana.yml
        read_only: true
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - elasticsearch

  lamp:
    build:
      context: lamp/
      dockerfile: Dockerfile
    networks:
      - elk
    environment:
      - elasticsearch_password=$elasticsearch_password
    volumes:
      - ./lamp/packetbeat.yml:/etc/packetbeat/packetbeat.yml
      - ./lamp/filebeat.yml:/etc/filebeat/filebeat.yml
      - ./lamp/metricbeat.yml:/etc/metricbeat/metricbeat.yml
      - ./lamp/heartbeat.yml:/etc/heartbeat/heartbeat.yml
      - ./lamp/start_service.sh:/var/www/html/start_service.sh
      - ./lamp/suricata.yaml:/etc/suricata/suricata.yaml
      - ./lamp/sql.rules:/usr/share/suricata/rules/sql.rules

  lb:
    image: dockercloud/haproxy
    links:
      - lamp
      - mysql:mysql
    ports:
      - "80:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - elk

  mysql:
    build:
      context: mysql/
      dockerfile: Dockerfile
    restart: on-failure:5
    environment:
      - MYSQL_ROOT_PASSWORD=Passw0rd!
      - elasticsearch_password=$elasticsearch_password
    networks:
      - elk
    volumes:
      - ./database:/var/lib/mysql
      - ./mysql/filebeat.yml:/etc/filebeat/filebeat.yml
      - ./mysql/metricbeat.yml:/etc/metricbeat/metricbeat.yml
      - ./mysql/heartbeat.yml:/etc/heartbeat/heartbeat.yml
      - ./mysql/start_service.sh:/start_service.sh
      - ./mysql/my.cnf:/etc/mysql/my.cnf


networks:
  elk:
    driver: bridge

volumes:
  elasticsearch: