travisboss/docker

Deploy pfelk with docker-compose

docker-pfelk

Deploy pfelk with docker-compose Video Tutorial

(0) Required Prerequisits

• Docker
• Docker-Compose
• Adequate Memory (i.e. 4GB+)

(1) Docker Install

sudo apt-get install docker

sudo apt-get install docker-compose

(2) Download pfELK Docker

sudo wget https://github.com/pfelk/docker/archive/refs/heads/main.zip

(2a) Unzip pfelkdocker.zip

sudo apt-get install unzip

sudo unzip main.zip

(3) Memory

(3a) Set vm.max_map_count to no less than 262144 (must run each time host is booted)

sudo sysctl -w vm.max_map_count=262144

(3b) Set vm.max_map_count to no less than 262144 (one time configuration)

sudo echo "vm.max_map_count=262144" >> /etc/sysctl.conf

(4) Start Docker

sudo docker-compose up

Once fully running, navigate to the host ip (ex: 192.168.0.100:5601)

Scaling out pfelk

Replace docker-compose.yml with this version of docker-compose.yml

(0) Prerequisites

Please visit the following documentation for additional details.

Randomize published ports

Use either --publish-all or enable random ports for hosts, for example:

  elasticsearch:
    ports:
      - '9200'

Enable the data path to be shared by multiple nodes

For example, if you want to scale out to 3 nodes, use the following value:

  elasticsearch:
    environment:
      node.max_local_storage_nodes: '3'

(1) Scale out pfelk

Scale out your deployment to 3 nodes by running the following command:

sudo docker-compose up -d --scale pfelk=3

(4) Finalizing

Finalize templates and dashboards here