Beats in docker after 7.17

Elastic Stack Beats
,
1

Hello

Found problem with dockers image of beats from version 7.17 and higher.
Early images was near 600 Mb size
After 7.17 image baset on lightweight image near 300 Mb

But in new images:

  • no tzdate, so cant use -e TZ=Africa/Lusaka always date show in"Europe" TZ
  • no any text editor, so cant change any file inside docker

Now can't use new docker images becouse all logs timestemp different and hard to debuging

2

Did anybody have any idea?

3

The docker base image was changed to Ubuntu 20 in 7.17. The change is in the changelog for 7.17: Beats version 7.17.0 | Beats Platform Reference [8.1] | Elastic

I don't know that the commands you are missing were intentionally removed, they are just not provided by the standard Ubuntu 20 base image we use. To work around this you would have to create a new image with the packages you need installed using the filebeat container as a base image.

4

Changes in all images, and i don't know how corectly install additional packages in each container on each server in different time zones without corrupt main application. And that changes need to make after each version upgrade what make upgrades hard.

Perhaps there are containers based on more complete ubuntu images, where there is pre-installed: tzdate and any text editor?

5

You can extend the filebeat docker image and just deploy that everywhere with a simple docker build command.

You should just need a dockerfile like this and then you can produce and deploy a new image with docker build.

FROM docker.elastic.co/beats/filebeat:7.17.3
RUN apt-get update && apt-get install -y \
  vim \
  tzdata \
6

I need only run this dockerfile, or need add at end of dockerfile command to run application?

CMD /usr/share/filebeat/filebaet
or
RUN /usr/share/filebeat/filebaet

May be you know is not any planes to add that packages to core image for future releases? Because it's not problem to make changes in one or two hosts, but it's to hard make changes in docker images on more than twenty servers.

7

Are there any changes planned for the new docker images?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.