The compose-file is building the filebeat image as follows:
FROM docker.elastic.co/beats/filebeat:5.2.2
COPY /usr/share/filebeat/filebeat.yml /usr/share/filebeat/filebeat.yml
And the filebeat configuration is:
filebeat.prospectors:
- input_type: log
  paths:
    - /hostfs/var/lib/docker/containers/*/*.log
  document_type: docker
  json.message_key: log
output.logstash:
  hosts: ["logstash:5044"]
The container I believe is running as 'filebeat` as in https://github.com/elastic/beats-docker/blob/master/templates/Dockerfile.j2.
That's exactly what my question was about. Should I build my own filebeat image fixing the permissions thing?
Maybe the UID and GID used in the Dockerfile should be build configurable?