# Filebeat docker help with creating the container **URL:** \ **Category:** Beats\ **Tags:** docker, filebeat\ **Created:** [February 18, 2020, 10:36am UTC](https://discuss.elastic.co/t/filebeat-docker-help-with-creating-the-container/219760 "2020-02-18T10:36:41Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![zebulyon](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zebulyon](https://discuss.elastic.co/u/zebulyon)\ **Post date:** [February 18, 2020, 10:36am UTC](https://discuss.elastic.co/t/filebeat-docker-help-with-creating-the-container/219760/1 "2020-02-18T10:36:42Z")
Hello, complete beginner with the ELK-stack here so this might be really trivial. I'm using the docker image `docker.elastic.co/beats/filebeat:7.6.0` as well as the other corresponding images of the ELK-stack all of version 7.6.0. These are the three version of commands I'm using to try and create the container: **VER 1** ``` docker run -d \ --name=filebeat \ --user=root \ --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \ --volume="$(pwd)/filebeat_input.log:/usr/share/filebeat/sample.log:ro" \ --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" \ --volume="/var/run/docker.sock:/var/run/docker.sock:ro" \ --link 64bc6d9b5663:elasticsearch \ docker.elastic.co/beats/filebeat:7.6.0 filebeat \ -E output.elasticsearch.hosts=["elasticsearch:9200"] ``` VER 1 give me this as the error response when trying to run it. `Exiting: error loading config file: config file ("filebeat.yml") must be owned by the user identifier (uid=0) or root` **VER 2** So read up some and added the setup setup -strict.perms=false ``` docker run -d \ --name=filebeat \ --user=root \ --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \ --volume="$(pwd)/filebeat_input.log:/usr/share/filebeat/sample.log:ro" \ --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" \ --volume="/var/run/docker.sock:/var/run/docker.sock:ro" \ --link [CONTAINER_ID_ELASTICSEARCH]:elasticsearch \ docker.elastic.co/beats/filebeat:7.6.0 setup -strict.perms=false filebeat \ -E output.elasticsearch.hosts=["elasticsearch:9200"] ``` While VER 2 gives me this as my response: ``` Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling. Index setup finished. Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http://localhost:5601/api/status fails: fail to execute the HTTP GET request: Get http://localhost:5601/api/status: dial tcp 127.0.0.1:5601: connect: connection refused. Response: . ``` **VER 3** Thought that ok it needs to be linked to Kibana as well so added `--link [CONTAINER_ID_KIBANA]:kibana \` ``` docker run -d \ --name=filebeat \ --user=root \ --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \ --volume="$(pwd)/filebeat_input.log:/usr/share/filebeat/sample.log:ro" \ --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" \ --volume="/var/run/docker.sock:/var/run/docker.sock:ro" \ --link [CONTAINER_ID_ELASTICSEARCH]:elasticsearch \ --link [CONTAINER_ID_KIBANA]:kibana \ docker.elastic.co/beats/filebeat:7.6.0 filebeat \ -E output.elasticsearch.hosts=["elasticsearch:9200"] ``` Which gives me the same response as VER 1: ``` Exiting: error loading config file: config file ("filebeat.yml") must be owned by the user identifier (uid=0) or root ``` This is my filebeat.yml file: ``` filebeat.config: modules: path: ${path.config}/modules.d/*.yml reload.enabled: false filebeat.inputs: type: log enabled: true paths: ./sample.log processors: - add_cloud_metadata: ~ - add_docker_metadata: ~ output.elasticsearch: hosts: '${localhost:elasticsearch:9200}' ``` All of these are based on the examples provided in `https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html` Thanks in advance to anyone that can assist me, ---
**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\ **Post date:** [February 18, 2020, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-docker-help-with-creating-the-container/219760/2 "2020-02-18T13:17:17Z")
@zebulyon can you check the ownership of the configmap (filebeat.yml). The file must be owned by the root, something like: ``` -rw-r--r--. 1 root root ``` ---
**Author:** ![zebulyon](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zebulyon](https://discuss.elastic.co/u/zebulyon)\ **Post date:** [February 19, 2020, 11:22am UTC](https://discuss.elastic.co/t/filebeat-docker-help-with-creating-the-container/219760/3 "2020-02-19T11:22:58Z")
Thank you for the quick response. When using the `ls -l filebeat.yml` command I get this response ``` -rw-r--r-- 1 filebeat filebeat 295 Feb 18 16:57 filebeat.yml ``` ![Selection_001](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c2231149f6b79350345c5fb32baff99f362e2919.png) Have tried using the `chown` command found here [https://www.elastic.co/guide/en/beats/libbeat/5.3/config-file-permissions.html](https://www.elastic.co/guide/en/beats/libbeat/5.3/config-file-permissions.html) ---
**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\ **Post date:** [February 19, 2020, 4:45pm UTC](https://discuss.elastic.co/t/filebeat-docker-help-with-creating-the-container/219760/4 "2020-02-19T16:45:04Z")
@zebulyon you don't have to change the ownership of filebeat directory, but for the config file, i.e. filebeat.yml. You should try something like: `chown root:root filebeat.yml` followed by: `chmod og-w filebeat.yml` Also, I'd suggest you to follow the Elastic documentation for your version of stack (you are using 7.x but referring the docs for 5.x): [https://www.elastic.co/guide/en/beats/libbeat/7.x/config-file-permissions.html](https://www.elastic.co/guide/en/beats/libbeat/7.x/config-file-permissions.html) ---
**Author:** ![zebulyon](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zebulyon](https://discuss.elastic.co/u/zebulyon)\ **Post date:** [February 21, 2020, 8:49am UTC](https://discuss.elastic.co/t/filebeat-docker-help-with-creating-the-container/219760/5 "2020-02-21T08:49:05Z")
I tried using your commands and some other similar ones but I still get the same result As long as I try to simply run the command `filbeat` ![2020-20_normal_run](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74e3ee2e05a5e66096082781c82646cb00b97181.png) I have also tried the command `filebeat setup -E -strict.perms=false` but I get the exact same result. `Exiting: error loading config file: config file ("filebeat.yml") must be owned by the user identifier (uid=0) or root` ---
**Author:** ![zebulyon](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zebulyon](https://discuss.elastic.co/u/zebulyon)\ **Post date:** [February 23, 2020, 5:20pm UTC](https://discuss.elastic.co/t/filebeat-docker-help-with-creating-the-container/219760/6 "2020-02-23T17:20:35Z")
I have managed to solve the problem. It seems like when copying the file into the docker container using this command ` --volume="$(pwd)/filebeat_input.log:/usr/share/filebeat/sample.log:ro" \` This leads to the file filebeat.yml somehow being given a permission requirement that the container is unable to provide. I am however confused to why this does not apply to the file sample.log considering it uses the same command : ` --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 22, 2020, 5:20pm UTC](https://discuss.elastic.co/t/filebeat-docker-help-with-creating-the-container/219760/7 "2020-03-22T17:20:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.