Need some help setting up a "simple" ELK stack

Rancher 1.x
1

I’m trying to create a simple docker elk stack to run in Rancher.
All of the containers should run on the same host, so that’s what I’m
setting the host_label.

The reason for my post here is that I can run this with docker-compose, on the same VM Host, and
kibana comes up and connects to elasticsearch. But in Rancher, on the same VM Host,
I get the following error:

kibana_1 |
log [16:11:16.888]
[error][status][plugin:elasticsearch] Status changed from yellow to red -
Request Timeout after 1500ms

I’ve tried running this docker-ocmpose file with the rancher-compose CLI and as a custom catalog entry and the results are the same.

I did try a little guessing from looking around in your ELK catalog entries, but they are much more complex (and I’m sure very well thought out), but I just want something very simple.

Please, advise…

====== docker-compose.yml =========

elasticsearch:
  image: elasticsearch:latest
  ports:
    - "9200:9200"
    - "9300:9300"
  expose:
    - "9200"
    - "9300"
  volumes:
    - "/var/esdata:/usr/share/elasticsearch/data"
  labels:
    io.rancher.container.pull_image: always
    io.rancher.scheduler.affinity:host_label: ${HOST_LABEL}
    io.rancher.container.hostname_override: container_name
kibana:
  image: kibana:latest
  command: 
    - kibana
  ports:
    - "5601:5601"
  expose:
    - "5601"
  links:
    - elasticsearch:elasticsearch
  environment:
    ELASTICSEARCH_URL: "http://elasticsearch:9200"
  labels:
    io.rancher.container.pull_image: always
    io.rancher.scheduler.affinity:host_label: ${HOST_LABEL}
    io.rancher.container.hostname_override: container_name
 logstash:
  image: rcdn6-vm67-9.cisco.com/dot-logstash
  command: 
    - /docker-entrypoint.sh 
    - -f 
    - /etc/logstash/conf.d/*.conf
  ports:
    - "5000:5000"
  expose:
    - "5000"
  links:
    - elasticsearch:elasticsearch
  labels:
    io.rancher.container.pull_image: always
    io.rancher.scheduler.affinity:host_label: ${HOST_LABEL}
    io.rancher.container.hostname_override: container_name
2

I’m not an ELK expert, but running any docker-compose.yml in the CLI and using a custom catalog entry and even dumping it into the “Add Stack” page will all perform the same action. :slight_smile: They are all using rancher-compose to launch items.

Another tip is when pasting your compose files, it’s much easier to read (and allow you to format so that we could try it out) if you put in three backticks at the beginning and end of your code. I’ve done it above for your existing code block.

3

Shouldn’t the port for Logstash be 9292?

4

Also, since this is all on the same host, could it be hairpin NAT issue?

5

I installed v56 of Rancher this morning, and my simple ELK stack works.

Thanks