Skip to content
Get packs

Guide · Open source

How to use docker-elk: run the Elastic stack with Docker Compose

Updated · written with AI from the project's own documentation and checked against our catalogue data

docker-elk is a template that starts Elasticsearch, Logstash and Kibana (the Elastic stack, often called ELK) with Docker and Docker Compose, so you do not have to install each piece by hand. This guide walks through the requirements, the startup commands, logging in to Kibana, and how to set real passwords. After following it, you will have a working local stack you can experiment with and modify.

ELKdeviantony/docker-elk · ★ 18.4k · MIT

Quick start

  1. 1Check requirements. Confirm Docker Engine 18.06.0 or newer, Docker Compose 2.0.0 or newer, 1.5 GB of RAM and Git are available.
  2. 2Clone the repository. Run git clone on the Docker host to download docker-elk.
  3. 3Initialize users. Run docker compose up setup and wait for it to finish without errors.
  4. 4Start the stack. Run docker compose up, optionally with -d to run in the background.
  5. 5Log in to Kibana. Wait about a minute, then open http://localhost:5601 and sign in as elastic.
  6. 6Reset default passwords. Reset the elastic, logstash_internal and kibana_system passwords and update the .env file.

What the requirements are before you start

You need Docker Engine 18.06.0 or newer and Docker Compose 2.0.0 or newer, plus at least 1.5 GB of RAM on the host. Git is needed to clone the repository.

On Linux, your user must have permission to talk to the Docker daemon.

  • Docker Engine 18.06.0 or newer
  • Docker Compose 2.0.0 or newer
  • 1.5 GB of RAM
  • Git

Which ports does the stack use?

By default the stack exposes these ports, so make sure nothing else on your machine is using them.

  • 5044: Logstash Beats input
  • 50000: Logstash TCP input
  • 9600: Logstash monitoring API
  • 9200: Elasticsearch HTTP
  • 9300: Elasticsearch TCP transport
  • 5601: Kibana

Clone the repository and initialize users

Clone the repository onto the Docker host that will run the stack. Then run the setup service, which initializes the Elasticsearch users and groups that docker-elk needs.

git clone https://github.com/deviantony/docker-elk.git docker compose up setup

Start the stack and open Kibana

Once setup finishes without errors, start the remaining components. Give Kibana about a minute to initialize, then open http://localhost:5601 in a browser. The README gives the default login as user elastic with password changeme. You can also append the -d flag to run everything in the background.

docker compose up

Replace the default passwords

The changeme password is set for the elastic, logstash_internal and kibana_system users on first startup and the README calls it unsafe. Reset each one with the Elasticsearch password tool, note the generated values, and then put the new elastic password into the .env file. Its value is not used by core components, but the optional extensions use it to connect to Elasticsearch. If you do not plan to use the extensions, or you create your own roles and users, you can remove ELASTIC_PASSWORD from the file.

  • Run the reset command for elastic, logstash_internal and kibana_system
  • Save the generated passwords
  • Update ELASTIC_PASSWORD in the .env file
docker compose exec elasticsearch bin/elasticsearch-reset-password --batch --user elastic docker compose exec elasticsearch bin/elasticsearch-reset-password --batch --user logstash_internal docker compose exec elasticsearch bin/elasticsearch-reset-password --batch --user kibana_system

Generate Kibana encryption keys (optional)

The README describes generating encryption keys for Kibana as optional but highly recommended. Run the command below and copy its output into the Kibana configuration file at kibana/config/kibana.yml.

docker compose up kibana-genkeys

Know the limits of this setup

docker-elk is described as a template for learning and experimenting, not a production blueprint. Elasticsearch bootstrap checks are purposely disabled for development. For production, the README points to the Elasticsearch guide on Important System Configuration. The default image also includes a trial: Platinum features are enabled for 30 days, after which you keep the free Open Basic features without losing data. The README says you can opt out through its How to disable paid features section.

What people use it for

  • Trying the Elastic stack on a single laptop or workstation
  • Learning how Elasticsearch stores data, Logstash transforms it and Kibana visualizes it
  • Prototyping a log or data analysis pipeline before production planning
  • Starting from a template you can modify for your own configuration

Frequently asked questions

Is docker-elk free to use?

docker-elk is released under the MIT licence. The stack includes a 30-day Platinum trial by default, after which the README says you keep access to the free features of the Open Basic license without manual steps.

What do I need to run docker-elk?

You need Docker Engine 18.06.0 or newer, Docker Compose 2.0.0 or newer, at least 1.5 GB of RAM and Git to clone the repository. On Linux your user must be allowed to use the Docker daemon.

What is the default Kibana login?

The README lists user elastic and password changeme as the defaults. These are described as unsafe, so reset them after the first start.

Why is Kibana not loading at localhost:5601?

The README says to give Kibana about a minute to initialize after startup. Also confirm that docker compose up setup finished without errors and that port 5601 is not used by another program.

Can I use docker-elk in production?

The README says it is not a blueprint for a production-ready deployment and that bootstrap checks are disabled for development. For production it recommends following the Elasticsearch documentation on Important System Configuration.

How does docker-elk compare to other options?

The source lists Elastic's official docker-compose examples, OpenSearch Dashboards with OpenSearch, and Grafana Loki as comparable projects. The README itself does not compare them, so check each project's documentation for differences.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

docker-elk suits developers, students and teams who want to try the Elastic stack on one machine or start a modifiable template. Skip it for production, for machines with less than 1.5 GB of RAM, or if you cannot use the Docker daemon.

Install options & downloads