# Docker SIEM install
**URL:** https://discuss.elastic.co/t/docker-siem-install/349661
**Category:** Elastic Security
**Tags:** docker
**Created:** [December 19, 2023, 2:33pm UTC](https://discuss.elastic.co/t/docker-siem-install/349661 "2023-12-19T14:33:03Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Mike\_Kirby](https://discuss.elastic.co/u/Mike_Kirby)
#### Post date: [December 19, 2023, 2:33pm UTC](https://discuss.elastic.co/t/docker-siem-install/349661/1 "2023-12-19T14:33:03Z")
I am at the beginning of a new ELK SIEM installation and am looking to verify a couple of items.
1. When creating the SIEM in docker the documentation does not say to pull the Logstash component. Is there a reason for this? Can it be pulled with the same string as elasticsearch and kibana
```auto
docker pull docker.elastic.co/logstash/logstash:8.11.3
```
1. When creating this in a docker environment, should I be configuring the 3 servers (ES, Kib,Log) as normal servers in terms of sizing?
Thank you for the feedback. Wanting to set this up correctly the first time.
---
### Author:  [@Mike\_Kirby](https://discuss.elastic.co/u/Mike_Kirby)
#### Post date: [January 8, 2024, 2:14pm UTC](https://discuss.elastic.co/t/docker-siem-install/349661/2 "2024-01-08T14:14:35Z")
I have been able to get past this phase of the installation.
I created the 3 servers as per normal. From there I used Podman to create pods for the SIEM components and then containers in the pods.
Logstash and Kibana are running however, I am unable to start the Elasticsearch containers.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 5, 2024, 2:15pm UTC](https://discuss.elastic.co/t/docker-siem-install/349661/3 "2024-02-05T14:15:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.