update docker compose ports

docker-compose.yml

@@ -8,8 +8,10 @@ services:
       - "1515:1515"
       - "514/udp:514/udp"
       - "55000:55000"
-    networks:
-      - docker_elk
+#    networks:
+#      - docker_elk
+    depends_on:
+      - elasticsearch
   elasticsearch:
     image: elasticsearch:latest
     command: elasticsearch -E node.name="node-1" -E cluster.name="wazuh " -E network.host=0.0.0.0
@@ -18,8 +20,8 @@ services:
       - "9300:9300"
     environment:
       ES_JAVA_OPTS: "-Xms1g -Xmx1g"
-    networks:
-      - docker_elk
+#    networks:
+#      - docker_elk
   logstash:
     build: logstash/
     command: -f /etc/logstash/conf.d/
@@ -27,8 +29,8 @@ services:
       - "5000:5000"
     volumes_from:
       - wazuh
-    networks:
-      - docker_elk
+#    networks:
+#      - docker_elk
     depends_on:
       - elasticsearch
     environment:
@@ -37,11 +39,12 @@ services:
     build: kibana/
     ports:
       - "5601:5601"
-    networks:
-      - docker_elk
+#    networks:
+#      - docker_elk
     depends_on:
       - elasticsearch
+    entrypoint: ./wait-for-it.sh elasticsearch
 
-networks:
-  docker_elk:
-    driver: bridge
+#networks:
+#  docker_elk:
+#    driver: bridge

kibana/Dockerfile

@@ -1,5 +1,9 @@
 FROM kibana:5.0.2
 
+RUN apt-get update && apt-get install -y curl
+
 COPY ./config/kibana.yml /opt/kibana/config/kibana.yml
 
 RUN /usr/share/kibana/bin/kibana-plugin install http://wazuh.com/resources/wazuh-app.zip
+
+COPY config/wait-for-it.sh /

kibana/config/wait-for-it.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+host="$1"
+shift
+cmd="kibana"
+
+until curl -XGET $host:9200; do
+  >&2 echo "Elastic is unavailable - sleeping"
+  sleep 1
+done
+
+sleep 60
+
+>&2 echo "Elastic is up - executing command"
+exec $cmd

logstash/config/elastic5-ossec-template.json

@@ -12,7 +12,6 @@
         {
           "notanalyzed": {
             "match": "*",
-            "match_mapping_type": "string",
             "mapping": {
               "type": "keyword",
               "doc_values": "true"

wait-for-it.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -e
+
+host="$1"
+shift
+cmd="$@"
+
+until curl -XGET $host:9200; do
+  >&2 echo "Elastic is unavailable - sleeping"
+  sleep 1
+done
+
+>&2 echo "Elastic is up - executing command"
+exec $cmd