diff --git a/docker-compose.yml b/docker-compose.yml index f13f45aaf52b54cf6f413cd46c0262234aaeb86c..acb86feacd28ae8d5e1ca69a41884364044fed87 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -6,24 +6,55 @@ services: context: filebeat image: registry.shore.co.il/filebeat restart: always + user: root + volumes: + - filebeat:/usr/share/filebeat/data/ + - /var/lib/docker/containers:/var/lib/docker/containers:ro + - /var/run/docker.sock:/var/run/docker.sock:ro journalbeat: build: context: journalbeat image: registry.shore.co.il/journalbeat restart: always + user: root + volumes: + - journalbeat:/usr/share/journalbeat/data/ + - /var/log/journal:/var/log/journal + - /etc/machine-id:/etc/machine-id + - /run/systemd:/run/systemd + - /etc/hostname:/etc/hostname:ro metricbeat: build: context: metricbeat image: registry.shore.co.il/metricbeat + network_mode: host restart: always + user: root + volumes: + - metricbeat:/usr/share/metricbeat/data/ + - /var/run/docker.sock:/var/run/docker.sock:ro + - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro + - /proc:/hostfs/proc:ro + - /:/hostfs:ro packetbeat: build: context: packetbeat + cap_add: + - NET_ADMIN image: registry.shore.co.il/packetbeat + network_mode: host restart: always + volumes: + - packetbeat:/usr/share/packetbeat/data/ + +volumes: + filebeat: + journalbeat: + metricbeat: + packetbeat: networks: default: diff --git a/filebeat/filebeat.yml b/filebeat/filebeat.yml index 58df7c5a192c9f81877309ebce973186cf324c41..8847d1e88214a228cdf50de24eb002c73dbb4ee7 100644 --- a/filebeat/filebeat.yml +++ b/filebeat/filebeat.yml @@ -9,3 +9,11 @@ logging: http: enabled: true + +processors: + - add_host_metadata: ~ + - add_docker_metadata: ~ + +filebeat.inputs: + - type: container + enabled: true diff --git a/journalbeat/journalbeat.yml b/journalbeat/journalbeat.yml index 58df7c5a192c9f81877309ebce973186cf324c41..b14aecb235db54627533899fa455992c958c1e83 100644 --- a/journalbeat/journalbeat.yml +++ b/journalbeat/journalbeat.yml @@ -9,3 +9,6 @@ logging: http: enabled: true + +processors: + - add_host_metadata: ~ diff --git a/metricbeat/metricbeat.yml b/metricbeat/metricbeat.yml index 58df7c5a192c9f81877309ebce973186cf324c41..345342de255c9d4eb58510828eef47052606466d 100644 --- a/metricbeat/metricbeat.yml +++ b/metricbeat/metricbeat.yml @@ -9,3 +9,46 @@ logging: http: enabled: true + +processors: + - add_host_metadata: ~ + +metricbeat.config.modules: + path: ${path.config}/modules.d/*.yml + reload.enabled: false + +metricbeat.modules: + - module: system + metricsets: + - cpu + - load + - memory + - network + - process + - process_summary + - uptime + - socket_summary + - diskio + - filesystem + - fsstat + - service + system.hostfs: /hostfs + + - module: docker + metricsets: + - container + - cpu + - diskio + - event + - healthcheck + - info + - memory + - network + + - module: linux + metricsets: + - pageinfo + - memory + - conntrack + - iostat + hostfs: /hostfs diff --git a/packetbeat/Dockerfile b/packetbeat/Dockerfile index a9870478a9ab1e1da437da3547a61227ad81797d..1f6360e0917e1cdf7a68b17ff4c8aeb18907fa3a 100644 --- a/packetbeat/Dockerfile +++ b/packetbeat/Dockerfile @@ -1,4 +1,4 @@ FROM docker.elastic.co/beats/packetbeat-oss:7.12.1 COPY --chown=root:packetbeat packetbeat.yml /usr/share/packetbeat/packetbeat.yml -RUN packetbeat test config +#RUN packetbeat test config HEALTHCHECK CMD curl --fail http://localhost:5066/stats || exit 1 diff --git a/packetbeat/packetbeat.yml b/packetbeat/packetbeat.yml index 58df7c5a192c9f81877309ebce973186cf324c41..75d8ff17166acfe8021e8a7a1b17361d57d84a28 100644 --- a/packetbeat/packetbeat.yml +++ b/packetbeat/packetbeat.yml @@ -9,3 +9,22 @@ logging: http: enabled: true + +processors: + - add_host_metadata: ~ + +packetbeat.interfaces.device: any + +packetbeat.protocols: + - type: icmp + enabled: true + - type: dns + enabled: true + - type: http + enabled: true + ports: + - 80 + - type: tls + enabled: true + ports: + - 443