Docker Metricbeat 7.6.0 doesn't send Host processes

[gregbk (greg)]

Hello ELK community!

I tried to run a basic setup with ELK version 7.6.0

Metricbeat.yml

metricbeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    # Reload module configs as they change:
    reload.enabled: false

metricbeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

metricbeat.modules:
- module: system
  metricsets:
    - "cpu"
    - "load"
    - "filesystem"
    - "fsstat"
    - "memory"
    - "network"
    - "process"
    - "core"
    - "diskio"
    - "socket"
  period: 5s
  enabled: true
  processes: ['.*']
  cpu.metrics:  ["percentages"]
  core.metrics: ["percentages"]
  process.cgroups.enabled: false

- module: docker
  metricsets:
    - "container"
    - "cpu"
    - "diskio"
    - "healthcheck"
    - "info"
    - "image"
    - "memory"
    - "network"
  hosts: ["unix:///var/run/docker.sock"]
  period: 10s
  enabled: true

output.elasticsearch:
  hosts: ${ELASTIC_HOST}
  username: ${ELASTIC_USER}
  password: ${ELASTIC_PASSWORD}
  ssl.verification_mode: ${SSL_VERIFICATION_MODE} # option: [none|full] , put none for local install as localhost/elastic hostname is invalid in cert
 
#logging.level: debug

And docker-compose.yml

version: "3.7"

services:

  metricbeat:
    container_name: metricbeat
    image: docker.elastic.co/beats/metricbeat:7.6.0
    user: root
    volumes:
      - ./config/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /proc:/hostfs/proc:ro
      - /:/hostfs:ro
    environment:
      - ELASTIC_HOST=https://${ELASTIC_URL}:443
      - ELASTIC_USER=${ELASTIC_USER}
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - SSL_VERIFICATION_MODE=${SSL_VERIFICATION_MODE}
    command: ["-strict.perms=false"] # disable strict permission checks
    network_mode: host
    cap_add:
      - sys_ptrace
      - dac_read_search

In kibana, metricbeat index, filter process.name:exist only list logs for process.name=metricbeat.
Same in HOST SYSTEM dashboard, I can see only 1 process metricbeat. I can see only metrics fine line system RAM, CPU, disk.

Something I missed in my config?

Thank you for your help!
Greg.

[gregbk (greg)]

I found my mistake:
I forgot to add the container CMD -e -system.hostfs=/hostfs
Like stated in the documentation:

docker run \
  --mount type=bind,source=/proc,target=/hostfs/proc,readonly \ 
  --mount type=bind,source=/sys/fs/cgroup,target=/hostfs/sys/fs/cgroup,readonly \ 
  --mount type=bind,source=/,target=/hostfs,readonly \ 
  --net=host \ 
  docker.elastic.co/beats/metricbeat:7.10.1 -e -system.hostfs=/hostfs

[Kaiyan_Sheng]

Thanks for posting your solution here!