Filebeat in a docker container

Elastic Stack Beats
#1

Dear community,
I have a server on openstack. This target I can reach from everywhere else beside from inside the filebeat docker on my laptop.

If I make an ip add on my laptop I get a bunch of IPs. All these IPs I can reach from inside the conainer. A ping to the target from inside the filebeat container is not possible - but possible from my laptop where the container runs.
That is why I get this error:
2021-02-19T13:28:42.177Z ERROR [publisher_pipeline_output] pipeline/output.go:155 Failed to connect to backoff(async(tcp://10.98.146.18:5044)): dial tcp 10.98.146.18:5044: i/o timeout
2021-02-19T13:28:42.178Z INFO [publisher_pipeline_output] pipeline/output.go:146 Attempting to reconnect to backoff(async(tcp://10.98.146.18:5044)) with 8 reconnect attempt(s)
Do you perhaps know how I can start the dock container / do so that it also finds / reach the target Ip? I do not understand the reason for this behaviour
Thank you and kind regards
Stefano

#2

Hey @smm,

This is more a question about networking :slightly_smiling_face:

Do you access to this server on OpenStack through some VPN?

Can filebeat access the server if you run it on the host network (with --net=host)?

Take a look to this question in stack overflow, it may be the a similar thing: networking - Docker container and host network VPN - Stack Overflow

#3

Hi jsoriano,
thanks for the input.
I found the solution I would like to share now:

docker run
--rm
--net host
--name=filebeat
--user=root
--volume="$(pwd)/filebeat.docker-local.yml:/usr/share/filebeat/filebeat.yml:ro"
--volume="/var/lib/docker/containers:/var/lib/docker/containers:ro"
--volume="/var/run/docker.sock:/var/run/docker.sock:ro"
docker.elastic.co/beats/filebeat:7.8.1 filebeat -e -strict.perms=false
Running on latets linux mint.
The --net host made the difference!
cheers
Stefano