Error when trying to run filebeat using docker-compose

[TflGustavo (Gustavo da Silva Cruz)]

I'm trying to run Elasticsearch, Kibana and Filebeat through docker-compose on Ubuntu. Elasticsearch and Kibana are starting normally, but Filebeat is giving an error in the filebeat.yml file.

I've already tried using different versions of Filebeat, but the problem remains the same.

Does anyone know how to solve it?

docker-compose.yml

version: '3.8'

services:   
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.16.2
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      discovery.type: "single-node"
      ES_JAVA_OPTS: "-Xms2g -Xmx2g"
      xpack.monitoring.enabled: "true"
    volumes:
      - ./esdata:/usr/share/elasticsearch/data
      
  filebeat:
    image: docker.elastic.co/beats/filebeat:7.16.2
    build: filebeat
    entrypoint: "filebeat -e -strict.perms=false"
    container_name: filebeat
    restart: unless-stopped
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - ./logs:/usr/share/filebeat/logs:ro
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "2"
    depends_on:
      - elasticsearch
      
  kibana:
    image: docker.elastic.co/kibana/kibana:7.16.2
    restart: always
    ports:
      - "5601:5601"
    environment:
      ELASTICSEARCH_URL: http://elasticsearch:9200
    depends_on:
      - elasticsearch
      
volumes:
  esdata:
    driver: local

[stephenb (Stephen Brown)]

Hi @TflGustavo Welcome to the community...

1st please do not post images of text, they are hard to read (and some can not read them), can not be searched , debugged etc..

The error seems to be more of a docker mount issue than a filebeat issue...
Take a close look at the docker volume mounts, is that a shared drive are there correct permissions etc.

[rtwolfe94022 (Tim Wolfe)]

[I put the image in my OCR server and pulled the text] I cannot guarantee that its a good answer:

The error indicates a problem with mounting the filebeat.yml file in the Filebeat container. Check the following:

1. The path to filebeat.yml on your host is correct and the file exists.
2. The filebeat.yml has proper permissions set and is readable.
3. The volume mount in your docker-compose.yml correctly maps the host file to the container file path, not a directory.
4. Restart Docker if necessary and ensure the Filebeat version is compatible with your ELK stack.
5. Use docker logs to check for more detailed errors after attempting to start Filebeat again.