ELK Stack Deployment Guide: Docker Compose, Kubernetes, and Production Patterns

You can run an ELK Stack three ways: a tutorial setup on your laptop with Docker Compose, a Kubernetes-managed deployment via the official Elastic Cloud on Kubernetes (ECK) operator, or a vendor-managed cloud service like Elastic Cloud or AWS OpenSearch Service. Each is appropriate for different stages and scales, and customers regularly run all three in parallel: laptops for development, ECK for self-managed production, and managed cloud for SaaS-friendly workloads.

This guide walks through each deployment path with working configuration, then covers the production patterns that matter regardless of how you deploy.

Path 1: Docker Compose for Development

For local development, Docker Compose runs a single-node Elastic Stack in five minutes. The only purpose is iteration speed; never run this configuration in production.

version: '3.8'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - ES_JAVA_OPTS=-Xms2g -Xmx2g
    ports: ['9200:9200']
    volumes: ['esdata:/usr/share/elasticsearch/data']

  kibana:
    image: docker.elastic.co/kibana/kibana:8.13.0
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    ports: ['5601:5601']
    depends_on: [elasticsearch]

  logstash:
    image: docker.elastic.co/logstash/logstash:8.13.0
    volumes: ['./pipeline:/usr/share/logstash/pipeline']
    ports: ['5044:5044']
    depends_on: [elasticsearch]

volumes:
  esdata:

Bring it up with docker compose up -d, point Kibana at http://localhost:5601, and you have a working stack for testing pipelines and dashboards. Disable security only for local use.

Path 2: ECK on Kubernetes for Self-Managed Production

Elastic Cloud on Kubernetes (ECK) is the operator-based deployment pattern for production self-managed clusters. The operator handles cluster provisioning, version upgrades, certificate management, and node-pool topology declaratively. The pattern fits naturally with argocd gitops services deployment workflows.

A minimal Elasticsearch cluster definition with role separation:

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: prod
spec:
  version: 8.13.0
  nodeSets:
    - name: master
      count: 3
      config:
        node.roles: ['master']
      podTemplate:
        spec:
          containers:
            - name: elasticsearch
              resources:
                requests: { memory: 4Gi, cpu: 1 }
                limits:   { memory: 4Gi, cpu: 2 }
    - name: hot
      count: 6
      config:
        node.roles: ['data_hot','data_content','ingest']
      volumeClaimTemplates:
        - metadata: { name: elasticsearch-data }
          spec:
            accessModes: ['ReadWriteOnce']
            resources: { requests: { storage: 1Ti } }
            storageClassName: gp3
      podTemplate:
        spec:
          containers:
            - name: elasticsearch
              resources:
                requests: { memory: 32Gi, cpu: 4 }
                limits:   { memory: 32Gi, cpu: 8 }
    - name: warm
      count: 4
      config:
        node.roles: ['data_warm']
      volumeClaimTemplates:
        - metadata: { name: elasticsearch-data }
          spec:
            accessModes: ['ReadWriteOnce']
            resources: { requests: { storage: 4Ti } }
            storageClassName: st1

The same operator pattern applies to Kibana and Beats (Elastic Agent). ECK manages certificate rotation, rolling upgrades, and shard rebalancing during node replacement.