I am at the beginning of a new ELK SIEM installation and am looking to verify a couple of items.
- When creating the SIEM in docker the documentation does not say to pull the Logstash component. Is there a reason for this? Can it be pulled with the same string as elasticsearch and kibana
docker pull docker.elastic.co/logstash/logstash:8.11.3
- When creating this in a docker environment, should I be configuring the 3 servers (ES, Kib,Log) as normal servers in terms of sizing?
Thank you for the feedback. Wanting to set this up correctly the first time.