Filebeat /usr/local/bin/docker-entrypoint line 8: exec: filebeat: not found

Elastic Stack Beats
1

Hi There,
I faced typical problem with filebeat. No matter which user (filebeat or root) I'm trying to launch filebeat 7.9.2 i'm getting:
filebeat | /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found
filebeat exited with code 127
I'm running on: oracle linux v8.1
Docker version 20.10.3, build 48d30b5
docker-compose version 1.27.4, build 40524192

Here's my docker-compose:

version: "2.4"
services:
  filebeat:
    image: docker.elastic.co/beats/filebeat:7.9.2
    container_name: filebeat
    environment:
      - publish-all

    user: root
    command: ["--strict.perms=false"]
    volumes:
      - "./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
      - "/proc:/hostfs/proc:ro"
      - "/:/hostfs:ro"
      - "/srv/filebeat:/usr/share/filebeat"
    network_mode: "host"

and here you have my filebeat.yml:

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

processors:
- add_cloud_metadata: ~
output.elasticsearch:
  hosts: ["https://IP:9200"]
  username: "elastic"
  password: "xxx"
  ssl.verification_mode: "full"
  ssl.certificate_authorities: /usr/share/fileabeat/config/certs/ca/ca.crt
2

Did you try this solution: RE: /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found - #4 by Michele_Chersich?

3

@mtojek
You meant adding this:
entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'
to the docker-comose ?

4

I added the entrypoint as it was mentioned in

Blockquote
entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'

Blockquote
so this is how my docker-compose file looks like now:

version: "2.4"
services:
  filebeat:
    entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'
    image: docker.elastic.co/beats/filebeat:7.9.2
    container_name: filebeat
    environment:
      - publish-all

    user: root
    command: ["--strict.perms=false"]
    volumes:
      - "./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
      - "/proc:/hostfs/proc:ro"
      - "/:/hostfs:ro"
      - "/srv/filebeat:/usr/share/filebeat"
    network_mode: "host"

and i'm still getting this:

Attaching to filebeat
filebeat    | /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found
filebeat exited with code 127

What am i doing wrong here ?

5

Why do you need this mount: /srv/filebeat:/usr/share/filebeat? Don't you overwrite filebeat hom edir with this property?

6

I needed this to mount certificate which should be somewhere available in the filebeat. Looks like it started to work:

Attaching to filebeat
filebeat    | 2021-03-02T15:20:28.622Z  INFO    instance/beat.go:640    Home path: [/usr/share/filebeat] Config path: [/usr/share/filebeat] Data path: [/usr/share/filebeat/data] Logs path: [/usr/share/filebeat/logs]
filebeat    | 2021-03-02T15:20:28.630Z  INFO    instance/beat.go:648    Beat ID: ae09d65d-be92-4f37-b306-a24341efcd54
filebeat    | 2021-03-02T15:20:28.630Z  INFO    [seccomp]       seccomp/seccomp.go:124  Syscall filter successfully installed
filebeat    | 2021-03-02T15:20:28.630Z  INFO    [beat]  instance/beat.go:976    Beat info       {"system_info": {"beat": {"path": {"config": "/usr/share/filebeat", "data": "/usr/share/filebeat/data", "home": "/usr/share/filebeat", "logs": "/usr/share/filebeat/logs"}, "type": "filebeat", "uuid": "ae09d65d-be92-4f37-b306-a24341efcd54"}}}

But I still need to mount my ca.crt (somewhere):

ilebeat    | 2021-03-02T15:20:28.632Z  ERROR   instance/beat.go:951    Exiting: error initializing publisher: 1 error: open /usr/share/fileabeat/config/certs/ca/ca.crt: no such file or directory reading /usr/share/fileabeat/config/certs/ca/ca.crt
filebeat    | Exiting: error initializing publisher: 1 error: open /usr/share/fileabeat/config/certs/ca/ca.crt: no such file or directory reading /usr/share/fileabeat/config/certs/ca/ca.crt
7

You can mount it wherever you want, but can't overwrite existing directories as you did.

To configure the path to CA, just update the field:

 ssl.certificate_authorities: /<path_to_ca>/ca.crt
1 Like
8

Hi,
I made a typo here:

/usr/share/*fileabeat*/config

Hmm what's wrong with mounting /srv/filebeat to /usr/share/filebeat ? In my example in fact it wasn't make sense to mount filebeat.yml (which is de facto in path /usr/share/filebeat) and /usr/share/filebet again - this made filebeat.yml available twice. Here is the working docker-compose file - maybe it will help someone else:

version: "2.4"
services:
  filebeat:
    entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'
    image: docker.elastic.co/beats/filebeat:7.9.2
    container_name: filebeat
    environment:
      - publish-all

    user: root
#    command: ["--strict.perms=false"]
    volumes:
      - "./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
      - "/proc:/hostfs/proc:ro"
      - "/:/hostfs:ro"
      - "/srv/filebeat/config:/usr/share/filebeat/config"
    network_mode: "host"
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.