Wazuh-Elasticsearch is necessary

[SitoRBJ]

Hello team,

Creating a module to have our own image of Wazuh-Elasticsearch has become necessary.

In addition to the inconvenience of having dependencies from one container in a different container, it is not the proper way to proceed.

A clear example is a case where an Elasticsearch container drops.

In that case, if the Elasticsearch container is created again, the Wazuh alerts template will not be loaded nor will the Wazuh API credentials be loaded, as these are steps that are being executed in the Kibana container entrypoint.

Best regards,

Alfonso Ruiz-Bravo

[SitoRBJ]

Hello team,

The PR #106 solves this issue.

Kind regards,

Alfonso Ruiz-Bravo

[SitoRBJ]

Hello team,

To perform good practices as done in other repositories, we have adapted the Elasticsearch Dockerfile to launch an Elasticsearch CMD.

The entrypoint.sh contains the options to execute the command independently of the user who launches it. If it is root the command generates problems, that's why, when it is root, a different execution is contemplated specifying the user with UID=1000.

This way of proceeding is obtained from the Elasticsearch repository:

https://github.com/elastic/elasticsearch-docker/blob/6.5.4/build/elasticsearch/bin/docker-entrypoint.sh

Best regards,

Alfonso Ruiz-Bravo