Filebeat 6.x could not support running under OS alpine

Elastic Stack Beats
11

Looks like the correct libc version is missing.

File output:

bash-4.3# file /usr/bin/filebeat
/usr/bin/filebeat: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=c0f19e6605040a74953d9e08abf380b345b2be53, with debug_info, not stripped

for comparison:

bash-4.3# file /usr/bin/file
/usr/bin/file: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-musl-x86_64.so.1, stripped

Checking for lib dependencies with ldd:

bash-4.3# ldd /usr/bin/filebeat
	/lib64/ld-linux-x86-64.so.2 (0x7f947c01c000)
	libpthread.so.0 => /lib64/ld-linux-x86-64.so.2 (0x7f947c01c000)
	libdl.so.2 => /lib64/ld-linux-x86-64.so.2 (0x7f947c01c000)
	libc.so.6 => /lib64/ld-linux-x86-64.so.2 (0x7f947c01c000)
bash-4.3# ls /lib64/ld-linux-x86-64.so.2
ls: /lib64/ld-linux-x86-64.so.2: No such file or directory

Installing missing dependencies:

bash-4.3# apk add libc6-compat
(1/1) Installing libc6-compat (1.1.16-r14)
OK: 281 MiB in 36 packages
bash-4.3# ls /lib64/ld-linux-x86-64*
/lib64/ld-linux-x86-64.so.2
bash-4.3# /usr/bin/filebeat -h
Usage:
  filebeat [flags]
  filebeat [command]

Available Commands:
  export      Export current config or index template
  help        Help about any command
  modules     Manage configured modules
  run         Run filebeat
  setup       Setup index template, dashboards and ML jobs
  test        Test config
  version     Show current version info

Flags:
  -E, --E setting=value      Configuration overwrite
  -M, --M setting=value      Module configuration overwrite
  -N, --N                    Disable actual publishing for testing
  -c, --c string             Configuration file, relative to path.config (default "filebeat.yml")
      --cpuprofile string    Write cpu profile to file
  -d, --d string             Enable certain debug selectors
  -e, --e                    Log to stderr and disable syslog/file output
  -h, --help                 help for filebeat
      --httpprof string      Start pprof http server
      --memprofile string    Write memory profile to this file
      --modules string       List of enabled modules (comma separated)
      --once                 Run filebeat only once until all harvesters reach EOF
      --path.config string   Configuration path
      --path.data string     Data path
      --path.home string     Home path
      --path.logs string     Logs path
      --plugin pluginList    Load additional plugins
      --setup                Load the sample Kibana dashboards
      --strict.perms         Strict permission checking on config files (default true)
  -v, --v                    Log at INFO level

Use "filebeat [command] --help" for more information about a command.

As I already mentioned, beats 6.x are build with cgo enabled by default. This way beats will be dynamically linked against gnu libc. But Alpine uses musl libc. The libc6-compat package provides a libc6 compatibility layer, based on musl. That is, I have no idea how stable beats with libc6-compat will run.

Beats 5.x did not use CGO -> statically compiled -> no libc required. That's why build a 5.x image did work well for you.

Compiling filebeat with an alpine image, or compile/link with cgo disabled, might give you some better results.

As you care about images sizes, when compilining filebeat with cgo disabled, you won't need alpine or any other linux distribution as base image. A scratch image with filebeat only will do. There are a many tutorials how to do this. From skimming the contents, this blog post seems fine. Uses a golang based container for building + builds a final 'scratch' image just containing the binary.

1 Like