version: '3.8'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.2
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false  # 禁用安全认证（测试用）
      - ES_JAVA_OPTS=-Xms512m -Xmx512m  # 限制内存
    ports:
      - "9200:9200"
    # 不挂载任何卷（数据不持久化）

  logstash:
    image: docker.elastic.co/logstash/logstash:8.13.2
    container_name: logstash
    ports:
      - "5044:5044"  # Filebeat 输入端口
    environment:
      - XPACK_MONITORING_ENABLED=false  # 禁用监控（测试用）
    command: logstash -e 'input { beats { port => 5044 } } output { elasticsearch { hosts => ["elasticsearch:9200"] } }'
    # 直接通过命令行配置 Logstash（无需外部文件）
    depends_on:
      - elasticsearch

  kibana:
    image: docker.elastic.co/kibana/kibana:8.13.2
    container_name: kibana
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch

  filebeat:
    image: docker.elastic.co/beats/filebeat:8.13.2
    container_name: filebeat
    user: root  # 避免权限问题
    volumes:
      - /var/log:/home/ubuntu/game/log:ro  # 挂载宿主机日志目录（只读）
    command: >
      filebeat -e --path.config /usr/share/filebeat
      -E "filebeat.inputs=[{type: log, enabled: true, paths: ['/var/log/*.log']}]"
      -E "output.logstash.hosts=[\"logstash:5044\"]"
    # 直接通过命令行配置 Filebeat（无需外部文件）
    depends_on:
      - logstash