latest(Dockerfile)
ElastAlert is a simple framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch.
docker run -d khezen/elastalert:latest run the following command on your host to make elasticsearch run properly:
sysctl -w vm.max_map_count=262144 You can set it permanently by modifying vm.max_map_count setting in your /etc/sysctl.conf.
version: '2' services: elastalert: image: khezen/elastalert environment: ELASTIC_PWD: changeme ELASTICSEARCH_HOST: localhost ELASTICSEARCH_PORT: 9200 volumes: - /etc/elastalert:/etc/elastalert - /usr/share/elastalert/rules:/usr/share/elastalert/rules network_mode: bridge restart: unless-stopped or
version: '2' services: elasticsearch: image: khezen/elasticsearch:2 environment: ELASTIC_PWD: changeme KIBANA_PWD: brucewayne BEATS_PWD: jdilla volumes: - /data/elasticsearch:/usr/share/elasticsearch/data - /etc/elasticsearch:/usr/share/elasticsearch/config ports: - "9200:9200" - "9300:9300" network_mode: bridge restart: unless-stopped kibana: links: - elasticsearch:elasticsearch-0 image: khezen/kibana:4 environment: KIBANA_PWD: brucewayne ELASTICSEARCH_HOST: elasticsearch-0 ELASTICSEARCH_PORT: 9200 volumes: - /etc/kibana:/etc/kibana ports: - "5601:5601" network_mode: bridge restart: unless-stopped elastalert: links: - elasticsearch:elasticsearch-0 image: khezen/elastalert environment: ELASTIC_PWD: changeme ELASTICSEARCH_HOST: elasticsearch-0 ELASTICSEARCH_PORT: 9200 volumes: - /etc/elastalert:/etc/elastalert - /usr/share/elastalert/rules:/usr/share/elastalert/rules network_mode: bridge restart: unless-stopped password for elasticsearch built-in user elastic.
Elasticsearch hostname.
Elasticsearch port.
Configuration file is located in /etc/elastalert/elastalert.yml if you follow the same volume mapping as in docker-compose examples above.
You can find help with elastalert configuration here.
You can share rules from host to the container by adding them to /usr/share/elastalert/rules if you follow the same volume mapping as in docker-compose examples above.
If you have any problems with or questions about this image, please ask for help through a GitHub issue.