Docker Metricbeat not getting the System Metrics from host

[Simon_Becker]

Hello there,

i am trying to get my host metrics forwarded through my metricbeat in a docker container.
I mounted all the neccecary directories, as shown in the docs here: https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-docker.html

This results in the following compose file:
services:
metricbeat:
container_name: metricbeat
build: ${PWD}/config/metricbeat
restart: always
user: root
volumes:
- /proc:/hostfs/proc:ro
- /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
- /:/hostfs:ro
- /var/run:/var/run #needs to connect to docker.sock in /var/run
networks:
- push-network
command: metricbeat -e -system.hostfs=/hostfs

Metricbeat collects all metrics via the system module.
Config looks like this:
- module: system
metricsets:
- cpu # CPU usage
- load # CPU load averages
- memory # Memory usage
- network # Network IO
- process # Per process metrics
- process_summary # Process summary
- uptime # System Uptime
- socket_summary # Socket summary
#- core # Per CPU core usage
#- diskio # Disk IO
#- filesystem # File system usage for each mountpoint
#- fsstat # File system summary metrics
#- raid # Raid
#- socket # Sockets and connection info (linux only)
enabled: true
period: 20s
processes: ['.*']

In Discover I can only see the metrics of the Metricbeat container, not the host. The field host.name always only contains the docker container ID, not the host name.

It would be great if someone could help me out there. Thanks y'all

[jdouk]

Hi,

The link you have attached has a section discussing the topic "Monitor the host machine" and states

"This example highlights the changes required to make the system module work properly inside of a container. This enables Metricbeat to monitor the host machine from within the container."

docker run
--mount type=bind,source=/proc,target=/hostfs/proc,readonly \
--mount type=bind,source=/sys/fs/cgroup,target=/hostfs/sys/fs/cgroup,readonly \
--mount type=bind,source=/,target=/hostfs,readonly \
--net=host \
docker.elastic.co/beats/metricbeat:7.4.2 -e -system.hostfs=/hostfs

It also describes in a detailed manner why all these changes are needed. Once you perform this then the Metricbeat container should be able to collect and forward all host metrics to your elasticsearch.

This should be also visible in the Kibana's infrastructure Tab

In case you want to see the actual host name in the file host.name you need to add the argument
--net=host \