11[[docker]]
22=== Running Logstash on Docker
33Docker images for Logstash are available from the Elastic Docker
4- registry.
4+ registry. The base image is https://hub.docker.com/_/centos/[centos:7].
55
6- The base image is https://hub.docker.com/_/centos/[centos:7] and the source
7- code can be found on
8- https://github.com/elastic/logstash-docker/tree/{branch}[GitHub].
6+ A list of all published Docker images and tags can be found at
7+ https://www.docker.elastic.co[www.docker.elastic.co]. The source code can be
8+ found on https://github.com/elastic/logstash-docker/tree/{branch}[GitHub].
99
10- The images are shipped with https://www.elastic.co/products/x-pack[X-Pack]
11- installed.
10+ ==== Image types
11+
12+ The images are available in two different configurations or "flavors". The
13+ `x-pack` flavor, which is the default, ships with X-Pack features
14+ pre-installed. The `oss` flavor does not include X-Pack, and contains only
15+ open source Logstash.
16+
17+ NOTE: https://www.elastic.co/guide/en/x-pack/current/index.html[X-Pack] is
18+ pre-installed in the default image. With X-Pack installed, Logstash expects to
19+ connect to an Elasticsearch cluster that is also running X-Pack, in order to
20+ publish data for the {xpack-ref}/monitoring.html[Monitoring] component.
1221
1322==== Pulling the image
1423Obtaining Logstash for Docker is as simple as issuing a +docker
@@ -23,22 +32,22 @@ endif::[]
2332
2433ifeval::["{release-state}"!="unreleased"]
2534
26- The Docker image for Logstash {logstash_version} can be retrieved with
27- the following command:
35+ Docker images can be retrieved with the following commands:
2836
2937["source","sh",subs="attributes"]
3038--------------------------------------------
3139docker pull {docker-image}
40+ docker pull {docker-repo}-oss:{logstash_version}
3241--------------------------------------------
3342
3443endif::[]
3544
36- ==== Configuring Logstash for Docker
45+ === Configuring Logstash for Docker
3746
3847Logstash differentiates between two types of configuration:
3948<<config-setting-files,Settings and Pipeline Configuration>>.
4049
41- ===== Pipeline Configuration
50+ ==== Pipeline Configuration
4251
4352It is essential to place your pipeline configuration where it can be
4453found by Logstash. By default, the container will look in
@@ -77,14 +86,14 @@ behaviour that you are observing, ensure that your pipeline
7786configuration is being picked up correctly, and that you are replacing
7887either +logstash.conf+ or the entire +pipeline+ directory.
7988
80- ===== Settings
89+ ==== Settings
8190
8291The image provides several methods for configuring settings. The conventional
8392approach is to provide a custom `logstash.yml` file, but it's
8493also possible to use environment variables to define settings.
8594
8695[[docker-bind-mount-settings]]
87- ==== Bind-mounted settings files
96+ ===== Bind-mounted settings files
8897
8998Settings files can also be provided through bind-mounts. Logstash
9099expects to find them at +/usr/share/logstash/config/+.
@@ -127,7 +136,8 @@ ADD config/ /usr/share/logstash/config/
127136Be sure to replace or delete `logstash.conf` in your custom image, so
128137that you don't retain the example config from the base image.
129138
130- ==== Environment variable configuration
139+ [[docker-env-config]]
140+ ===== Environment variable configuration
131141
132142Under Docker, Logstash settings can be configured via environment
133143variables. When the container starts, a helper process checks the environment
@@ -156,6 +166,29 @@ bind-mounted from the host system. Thus, it is not reccomended to
156166combine the bind-mount technique with the environment variable technique. It
157167is best to choose a single method for defining Logstash settings.
158168
169+ ==== Docker defaults
170+ The following settings have different default values when using the Docker
171+ images:
172+
173+ [horizontal]
174+ `http.host`:: `0.0.0.0`
175+ `path.config`:: `/usr/share/logstash/pipeline`
176+
177+ In the `x-pack` image, the following additional defaults are also set:
178+
179+ [horizontal]
180+ `xpack.monitoring.elasticsearch.url`:: `http://elasticsearch:9200`
181+ `xpack.monitoring.elasticsearch.username`:: `logstash_system`
182+ `xpack.monitoring.elasticsearch.password`:: `changeme`
183+
184+ These settings are defined in the default `logstash.yml`. They can be overridden
185+ with a <<docker-bind-mount-settings,custom `logstash.yml`>> or via
186+ <<docker-env-config,environment variables>>.
187+
188+ IMPORTANT: If replacing `logstash.yml` with a custom version, be sure to copy the
189+ above defaults to the custom file if you want to retain them. If not, they will
190+ be "masked" by the new file.
191+
159192==== Logging Configuration
160193
161194Under Docker, Logstash logs go to standard output by default. To
0 commit comments