docker-compose.yml

services:
  dashboard:
    networks:
      somenetwork:
    ports:
      - "5601:5601"
    image: kibana:8.16.1
    volumes:
      - ./data/dashboard:/usr/share/kibana/data
    environment:
      - "ELASTICSEARCH_HOSTS=http://elasticsearch:9200"
      - "xpack.security.enabled=false"
  elasticsearch:
    networks:
      somenetwork:
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      - "discovery.type=single-node"
      - "xpack.security.enrollment.enabled=false"
      - "xpack.security.enabled=false"
      - "ES_JAVA_OPTS=-Xms1024m -Xmx2048m"
    image: elasticsearch:8.16.1
    volumes:
      - ./data/elasticsearch:/usr/share/elasticsearch/data
  beats:
    image: docker.elastic.co/beats/filebeat:8.16.1
    networks:
      somenetwork:
    volumes:
      - ./data/suricata/logs:/suricata-logs
      - ./config/filebeats/filebeat.yml:/usr/share/filebeat/filebeat.yml
  suricata:
    build:
      context: ./Dockerfiles/suricata/.
    network_mode: host
    volumes:
      - ./config/suricata/suricata.yml:/etc/suricata/suricata.yml
      - ./data/suricata/rules:/var/lib/suricata/rules
      - ./data/suricata/logs:/var/log/suricata/
    # change wlp3s0 by result of ip addr
    command: /bin/bash -c "suricata-update && suricata -c /etc/suricata/suricata.yaml -i br_juice && tail -f /var/log/cron.log"
networks:
  somenetwork: