Elastic Search and Docker

Setting up an elasticsearch + kibana runtime is very easy to do with docker-compose:

version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.3.2
    environment:
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200:9200"
  kibana:
    image: docker.elastic.co/kibana/kibana:6.3.2
    ports:
      - "5601:5601"

For more information on the defaults (ulimits or environment variables, please see this post)

To run, you simply:

docker-compose up -d

And then navigate over to http://localhost:9200 for elasticsearch or http://localhost:5601 for kibana.

Gotchas

As with all things, there may be some gotchas associated with this setup. Specifically, you may notice that sometimes navigating to the URLs referenced above will result in connection errors.

This can be for quite a few reasons, I'll list some common ones I've encountered below.

Windows: ElasticSearch doesn't work

A few things to check - run a docker ps -a to ensure your container is running and for how long.

if it only lives for a few seconds, it may be due to a default max_map_count issue. To fix, if using docker-machine:

docker-machine ssh
sudo sysctl -w vm.max_map_count=262144
exit

If not using docker-machine, try:

docker exec -it <container_id> /bin/bash
sysctl -w vm.max_map_count=262144

NOTE: this will not persist after container is killed. TO make it "permanent" you might want to:

vi /etc/sysctl.conf
vm.max_map_count=262144

(press :q to exit)

vi /etc/rc.local
echo 262144 > /proc/sys/vm/max_map_count

source

Even after changes above, not working

One bit to note is that the docker container is simply wrapping the elasticsearch service. As such, sometimes it just takes a bit of time to load.

To ensure that elasticsearch is running properly, consider running:

docker-compose logs elasticsearch

This will display the log messages emitted as elasticsearch is booted inside your container.

example_elasticsearch | [2020-03-16T05:32:12,704][INFO ][o.e.n.Node               ] [IzFG4tZ] initialized
example_elasticsearch | [2020-03-16T05:32:12,704][INFO ][o.e.n.Node               ] [IzFG4tZ] starting ...
example_elasticsearch | [2020-03-16T05:32:12,959][INFO ][o.e.t.TransportService   ] [IzFG4tZ] publish_address {172.18.0.2:9300}, bound_addresses {0.0.0.0:9300}

Once you see those three lines, you should be safe to attempt your "healthcheck" such as visiting http://localhost:9200 in the browser or curling for it.

Alternatively, if something is foobar'd you'll see it here which gives you further clues as to what went wrong.