# Docker configuration for existing elk images

**URL:** <https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131>\
**Category:** Search Guard\
**Created:** [March 16, 2021, 12:44pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131 "2021-03-16T12:44:01Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![sivakumarreddy2026](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sivakumarreddy2026](https://forum.search-guard.com/u/sivakumarreddy2026)\
**Post date:** [March 16, 2021, 12:44pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/1 "2021-03-16T12:44:02Z")

</div>

If you think it is a bug report or you have a technical issue, please answer the following questions. For general questions, you can delete these questions.

\*\*Elasticsearch version:\*\*7.10.2

\*\*Server OS version:\*\*docker

**Kibana version (if relevant):**

**Browser version (if relevant):**

**Browser OS version (if relevant):**

\*\*Describe the issue:\*\*As per the documentation you are providing docker image along with kibana and elastic search, but how to download only searchgaurd image to configure with existing kibana and elasticsearch images on docker?

**Steps to reproduce:**  
1.  
2.  
3.

**Expected behavior:**

**Provide configuration:**  
elasticsearch/config/elasticsearch.yml  
elasticsearch/plugins/search-guard-7/sgconfig/sg\_config.yml  
kibana/config/kibana.yml (if relevant)

**Provide logs:**  
Elasticsearch  
Kibana (if relevant)

**Screenshots (if relevant):**

**Errors in browser console (if relevant):**

**Additional data:**

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [March 16, 2021, 1:38pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/2 "2021-03-16T13:38:15Z")

</div>

Due to the license change of Elasticsearch, we cannot provide you any Docker images for ES 7.11.0 and later.

You can find images for earlier versions at Docker hub:

[https://hub.docker.com/r/floragunncom/sg-elasticsearch/tags](https://hub.docker.com/r/floragunncom/sg-elasticsearch/tags)

Possibly, the SG helm charts are useful for you. Just announced:

[https://forum.search-guard.com/t/now-available-as-public-beta-helm-charts-for-search-guard/2132/2](https://forum.search-guard.com/t/now-available-as-public-beta-helm-charts-for-search-guard/2132/2)

---

<div class="post-metadata">

**Author:** ![sivakumarreddy2026](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sivakumarreddy2026](https://forum.search-guard.com/u/sivakumarreddy2026)\
**Post date:** [March 17, 2021, 5:08am UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/3 "2021-03-17T05:08:53Z")

</div>

are we need to have same version of elastic and kibana same as searchGaurd version for docker also??

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [March 17, 2021, 8:15am UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/4 "2021-03-17T08:15:27Z")

</div>

Yes, you need.

---

<div class="post-metadata">

**Author:** ![sivakumarreddy2026](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sivakumarreddy2026](https://forum.search-guard.com/u/sivakumarreddy2026)\
**Post date:** [March 17, 2021, 12:34pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/5 "2021-03-17T12:34:10Z")

</div>

1. When can we expect searchGaurd latest release of version 7.11.2 for docker image and manual setup??

2. How to setup searchGuard on existing elastic and kibana images on docker??

---

<div class="post-metadata">

**Author:** ![sivakumarreddy2026](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sivakumarreddy2026](https://forum.search-guard.com/u/sivakumarreddy2026)\
**Post date:** [March 17, 2021, 12:36pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/6 "2021-03-17T12:36:32Z")

</div>

With the docker image as you provided in official docs is up and running for elastic and kibana with basic auth,

how to connect beats image with elasticsearch image as it throwing ssl certificate error for beats connection.

can we disable SSL option in elasticsearch image??

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [March 17, 2021, 2:27pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/7 "2021-03-17T14:27:58Z")

</div>

> When can we expect searchGaurd latest release of version 7.11.2

Very soon.

> How to setup searchGuard on existing elastic and kibana images on docker??

Look at the Search Guard labs repository: [Files · master · search-guard / labs · GitLab](https://git.floragunn.com/search-guard/search-guard-labs/-/tree/master)

> … it throwing ssl certificate error for beats connection … can we disable SSL option in elasticsearch image??

It would be very bad do disable SSL in Search Guard. What errors do you see?  
I guess it will work if you skip certificate verification in beats. For example, in filebeat the setting is verification\_mode: none. [Configure SSL | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#server-verification-mode)

---

<div class="post-metadata">

**Author:** ![sivakumarreddy2026](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sivakumarreddy2026](https://forum.search-guard.com/u/sivakumarreddy2026)\
**Post date:** [March 18, 2021, 7:56am UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/8 "2021-03-18T07:56:55Z")

</div>

Exiting: couldn’t connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://_._._._:9200: 401 Unauthorized: Unauthorized]

we are facing below error for heartbeat when we provide elasticsearch public ip

tried with verification\_mode:none  
and  
output.elasticsearch.hosts: [“[https://192.168.1.42:9200](https://192.168.1.42:9200)”]  
output.elasticsearch.ssl.certificate\_authorities: [“/etc/pki/root/ca.pem”]  
output.elasticsearch.ssl.certificate: “/etc/pki/client/cert.pem”  
output.elasticsearch.ssl.key: “/etc/pki/client/cert.key”

passed these paths also both are not working

---

<div class="post-metadata">

**Author:** ![sivakumarreddy2026](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sivakumarreddy2026](https://forum.search-guard.com/u/sivakumarreddy2026)\
**Post date:** [March 18, 2021, 8:33am UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/9 "2021-03-18T08:33:40Z")

</div>

2021-03-18T14:02:00.571+0530 ERROR [publisher\_pipeline\_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://_:9200)): Get "https://..._:9200": x509: certificate is valid for 127.0.0.1, not _._._._

this is for external connection

output.elasticsearch:

# Array of hosts to connect to.

hosts: [“_._._._:9200”]

# Protocol - either `http` (default) or `https`.

protocol: “https”

ssl.certificate\_authorities: [C:/Users/sivak/Downloads/root-ca.pem]  
ssl.certificate: “C:/Users/sivak/Downloads/kirk.pem”  
ssl.key: “C:/Users/sivak/Downloads/kirk-key.pem”

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [March 18, 2021, 11:11am UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/10 "2021-03-18T11:11:54Z")

</div>

> Exiting: couldn’t connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://_._ ._._ :9200: 401 Unauthorized: Unauthorized]

Is it the same error or you just joined two errors?

> 2021-03-18T14:02:00.571+0530 ERROR [publisher\_pipeline\_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://_:9200)): Get "https://..._ :9200": x509: certificate is valid for 127.0.0.1, not _._ ._._

Where is this error from? It is hard to tell not seeing the entire log.

Please provide 2 logs (entire log for last 1 day):

1. Elasticsearch log
2. Beats log. What beats do you use?

Also, provide the configurations (entire files):

1. elasticsearch.yml
2. sg\_config.yml
3. beats configuration

The error `couldn’t connect to any of the configured Elasticsearch hosts` means that the system that produced the log can’t connect to Elasticsearch host. Are you sure the Elasticsearch host is reachable from that system? Maybe a firewall in the middle blocks the connection. Go to that system and check if the Elasticsearch 9200 port is open. You can do it with nmap or netcat.

```auto
nmap -p 9200 elasticsearch_host
nc -zv elasticsearch_host 9200

```

> we are facing below error for heartbeat when we provide elasticsearch public ip  
> output.elasticsearch.hosts: [“[https://192.168.1.42:9200](https://192.168.1.42:9200/)”]

The 192.168.1.42 is not a public IPv4 address, it is from the private subnet 192.168.0.0/16.

---

<div class="post-metadata">

**Author:** ![sivakumarreddy2026](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sivakumarreddy2026](https://forum.search-guard.com/u/sivakumarreddy2026)\
**Post date:** [March 22, 2021, 1:30pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/11 "2021-03-22T13:30:28Z")

</div>

Hi, how can we get docker image ( **non-OSS version** ) of searchgaurd along with kibana and elasticsearch

---

<div class="post-metadata">

**Author:** ![sivakumarreddy2026](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sivakumarreddy2026](https://forum.search-guard.com/u/sivakumarreddy2026)\
**Post date:** [March 22, 2021, 1:33pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/12 "2021-03-22T13:33:15Z")

</div>

Can we manually setup seachgaurd plugin as we did for windows in docker container with install command??  
elastic is up and running but kibana is not able to connect with elastic even though providing cert paths and auth creds properly

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [March 22, 2021, 4:07pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/13 "2021-03-22T16:07:30Z")

</div>

> how can we get docker image ( **non-OSS version** )

> Can we manually setup seachgaurd plugin as we did for windows in docker container with install command??

I don’t how you did it. But yes, it is possible to install the plugins in the container. Did you see the dockerfiles of the [search-guard/labs](https://git.floragunn.com/search-guard/search-guard-labs/-/tree/master)?

P.S.  
In 7.11 we have bug though, the Kibana plugin doesn’t work properly without Multitenancy. Make sure you have it enabled:

```auto
searchguard.multitenancy.enabled: true
searchguard.multitenancy.tenants.enable_global: true
searchguard.multitenancy.tenants.preferred: ["global"]
elasticsearch.requestHeadersWhitelist: ["authorization", "sgtenant"]

```

**Elasticsearch Dockerfile**

```auto
ARG ES_VERSION
ARG SG_VERSION
ARG CONTAINER_NAME
ARG AUTH

FROM docker.elastic.co/elasticsearch/elasticsearch:${ES_VERSION}

# Must repeat the docker-compose args to make them available after FROM
ARG ES_VERSION
ARG SG_VERSION
ARG CONTAINER_NAME
ARG AUTH

RUN elasticsearch-plugin install --batch https://maven.search-guard.com/search-guard-suite-release/com/floragunn/search-guard-suite-plugin/${ES_VERSION}-${SG_VERSION}/search-guard-suite-plugin-${ES_VERSION}-${SG_VERSION}.zip

# Copy Elasticsearch config
COPY ./config/${AUTH}/${CONTAINER_NAME}/*.pem /usr/share/elasticsearch/config/
COPY ./config/${AUTH}/${CONTAINER_NAME}/*.key /usr/share/elasticsearch/config/
COPY ./config/${AUTH}/${CONTAINER_NAME}/*.readme /usr/share/elasticsearch/config/
COPY ./config/${AUTH}/${CONTAINER_NAME}/*.yml /usr/share/elasticsearch/config/
COPY ./config/${AUTH}/${CONTAINER_NAME}/*.yml.example /usr/share/elasticsearch/config/

# Copy Search Guard config
COPY ./config/${AUTH}/${CONTAINER_NAME}/sgconfig/* /usr/share/elasticsearch/plugins/search-guard-7/sgconfig/

```

**Kibana Dockerfile**

```auto
ARG SG_VERSION
ARG KIBANA_VERSION
ARG CONTAINER_NAME
ARG AUTH

FROM docker.elastic.co/kibana/kibana:${KIBANA_VERSION}

# Must repeat the docker-compose args to make them available after FROM
ARG SG_VERSION
ARG KIBANA_VERSION
ARG CONTAINER_NAME
ARG AUTH

RUN kibana-plugin install https://maven.search-guard.com/search-guard-kibana-plugin-release/com/floragunn/search-guard-kibana-plugin/${KIBANA_VERSION}-${SG_VERSION}/search-guard-kibana-plugin-${KIBANA_VERSION}-${SG_VERSION}.zip 
COPY ./config/${AUTH}/${CONTAINER_NAME} /usr/share/kibana/config/

```

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [April 12, 2021, 4:08pm UTC](https://forum.search-guard.com/t/docker-configuration-for-existing-elk-images/2131/14 "2021-04-12T16:08:18Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.