docker-compose.yml

version: '3.2'

services:
  elasticsearch:
    build:
      context: elasticsearch/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./elasticsearch/config/elasticsearch.yml
        target: /usr/share/elasticsearch/config/elasticsearch.yml
        read_only: true
      - type: volume
        source: elasticsearch
        target: /usr/share/elasticsearch/data
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      ES_JAVA_OPTS: "-Xmx256m -Xms256m"
      # Use single node discovery in order to disable production mode and avoid bootstrap checks
      # see https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
      discovery.type: single-node
    networks:
      - elk

#   logstash:
#     build:
#       context: logstash/
#       args:
#         ELK_VERSION: $ELK_VERSION
#     volumes:
#       - type: bind
#         source: ./logstash/config/logstash.yml
#         target: /usr/share/logstash/config/logstash.yml
#         read_only: true
#       - type: bind
#         source: ./logstash/pipeline
#         target: /usr/share/logstash/pipeline
#         read_only: true
#     ports:
#       - "5000:5000"
#       - "9600:9600"
#     environment:
#       LS_JAVA_OPTS: "-Xmx256m -Xms256m"
#     networks:
#       - elk
#     depends_on:
#       - elasticsearch

  kibana:
    build:
      context: kibana/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./kibana/config/kibana.yml
        target: /usr/share/kibana/config/kibana.yml
        read_only: true
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - elasticsearch

  dvwa:
    build:
      context: dvwa/
      dockerfile: Dockerfile
    networks:
      - elk
    volumes:
      - ./dvwa/packetbeat.yml:/etc/packetbeat/packetbeat.yml
      - ./dvwa/filebeat.yml:/etc/filebeat/filebeat.yml
      - ./dvwa/metricbeat.yml:/etc/metricbeat/metricbeat.yml
      - ./dvwa/heartbeat.yml:/etc/heartbeat/heartbeat.yml
      - ./dvwa/start_service.sh:/var/www/html/start_service.sh
      - ./dvwa/suricata.yaml:/etc/suricata/suricata.yaml
      - ./dvwa/sql.rules:/usr/share/suricata/rules/sql.rules
    ports:
      - "80:80"
    links:
      - dvwamysql:dvwamysql

  dvwamysql:
    build:
      context: dvwamysql/
      dockerfile: Dockerfile
    restart: on-failure:5
    environment:
      - MYSQL_ROOT_PASSWORD=Passw0rd!
    networks:
      - elk
    volumes:
      - ./database:/var/lib/mysql
      - ./dvwamysql/filebeat.yml:/etc/filebeat/filebeat.yml
      - ./dvwamysql/metricbeat.yml:/etc/metricbeat/metricbeat.yml
      - ./dvwamysql/heartbeat.yml:/etc/heartbeat/heartbeat.yml
      - ./dvwamysql/start_service.sh:/start_service.sh
      - ./dvwamysql/my.cnf:/etc/mysql/my.cnf


networks:
  elk:
    driver: bridge

volumes:
  elasticsearch: