# Filebeat /usr/local/bin/docker-entrypoint line 8: exec: filebeat: not found
**URL:** https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927
**Category:** Beats
**Tags:** filebeat
**Created:** [March 2, 2021, 9:24am UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927 "2021-03-02T09:24:20Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Waxman](https://discuss.elastic.co/u/Waxman)
#### Post date: [March 2, 2021, 9:24am UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/1 "2021-03-02T09:24:20Z")
Hi There,
I faced typical problem with filebeat. No matter which user (filebeat or root) I'm trying to launch filebeat 7.9.2 i'm getting:
filebeat | /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found
filebeat exited with code 127
I'm running on: oracle linux v8.1
Docker version 20.10.3, build 48d30b5
docker-compose version 1.27.4, build 40524192
Here's my docker-compose:
```auto
version: "2.4"
services:
filebeat:
image: docker.elastic.co/beats/filebeat:7.9.2
container_name: filebeat
environment:
- publish-all
user: root
command: ["--strict.perms=false"]
volumes:
- "./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
- "/proc:/hostfs/proc:ro"
- "/:/hostfs:ro"
- "/srv/filebeat:/usr/share/filebeat"
network_mode: "host"
```
and here you have my filebeat.yml:
```auto
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
filebeat.autodiscover:
providers:
- type: docker
hints.enabled: true
processors:
- add_cloud_metadata: ~
output.elasticsearch:
hosts: ["https://IP:9200"]
username: "elastic"
password: "xxx"
ssl.verification_mode: "full"
ssl.certificate_authorities: /usr/share/fileabeat/config/certs/ca/ca.crt
```
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 2, 2021, 9:41am UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/2 "2021-03-02T09:41:47Z")
Did you try this solution: [RE: /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found - #4 by Michele\_Chersich](https://discuss.elastic.co/t/re-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/177648/4)?
---
### Author:  [@Waxman](https://discuss.elastic.co/u/Waxman)
#### Post date: [March 2, 2021, 10:03am UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/3 "2021-03-02T10:03:15Z")
@mtojek
You meant adding this:
`entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'`
to the docker-comose ?
---
### Author:  [@Waxman](https://discuss.elastic.co/u/Waxman)
#### Post date: [March 2, 2021, 10:35am UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/4 "2021-03-02T10:35:53Z")
I added the entrypoint as it was mentioned in
> Blockquote
> `entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'`
> Blockquote
> so this is how my docker-compose file looks like now:
```auto
version: "2.4"
services:
filebeat:
entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'
image: docker.elastic.co/beats/filebeat:7.9.2
container_name: filebeat
environment:
- publish-all
user: root
command: ["--strict.perms=false"]
volumes:
- "./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
- "/proc:/hostfs/proc:ro"
- "/:/hostfs:ro"
- "/srv/filebeat:/usr/share/filebeat"
network_mode: "host"
```
and i'm still getting this:
```auto
Attaching to filebeat
filebeat | /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found
filebeat exited with code 127
```
What am i doing wrong here ?
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 2, 2021, 2:15pm UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/5 "2021-03-02T14:15:13Z")
Why do you need this mount: `/srv/filebeat:/usr/share/filebeat`? Don't you overwrite filebeat hom edir with this property?
---
### Author:  [@Waxman](https://discuss.elastic.co/u/Waxman)
#### Post date: [March 2, 2021, 3:24pm UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/6 "2021-03-02T15:24:26Z")
I needed this to mount certificate which should be somewhere available in the filebeat. Looks like it started to work:
```auto
Attaching to filebeat
filebeat | 2021-03-02T15:20:28.622Z INFO instance/beat.go:640 Home path: [/usr/share/filebeat] Config path: [/usr/share/filebeat] Data path: [/usr/share/filebeat/data] Logs path: [/usr/share/filebeat/logs]
filebeat | 2021-03-02T15:20:28.630Z INFO instance/beat.go:648 Beat ID: ae09d65d-be92-4f37-b306-a24341efcd54
filebeat | 2021-03-02T15:20:28.630Z INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed
filebeat | 2021-03-02T15:20:28.630Z INFO [beat] instance/beat.go:976 Beat info {"system_info": {"beat": {"path": {"config": "/usr/share/filebeat", "data": "/usr/share/filebeat/data", "home": "/usr/share/filebeat", "logs": "/usr/share/filebeat/logs"}, "type": "filebeat", "uuid": "ae09d65d-be92-4f37-b306-a24341efcd54"}}}
```
But I still need to mount my ca.crt (somewhere):
```auto
ilebeat | 2021-03-02T15:20:28.632Z ERROR instance/beat.go:951 Exiting: error initializing publisher: 1 error: open /usr/share/fileabeat/config/certs/ca/ca.crt: no such file or directory reading /usr/share/fileabeat/config/certs/ca/ca.crt
filebeat | Exiting: error initializing publisher: 1 error: open /usr/share/fileabeat/config/certs/ca/ca.crt: no such file or directory reading /usr/share/fileabeat/config/certs/ca/ca.crt
```
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 3, 2021, 10:30am UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/7 "2021-03-03T10:30:17Z")
You can mount it wherever you want, but can't overwrite existing directories as you did.
To configure the path to CA, just update the field:
```auto
ssl.certificate_authorities: //ca.crt
```
---
### Author:  [@Waxman](https://discuss.elastic.co/u/Waxman)
#### Post date: [March 3, 2021, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/8 "2021-03-03T18:59:41Z")
Hi,
I made a typo here:
```auto
/usr/share/*fileabeat*/config
```
Hmm what's wrong with mounting /srv/filebeat to /usr/share/filebeat ? In my example in fact it wasn't make sense to mount filebeat.yml (which is de facto in path /usr/share/filebeat) and /usr/share/filebet again - this made filebeat.yml available twice. Here is the working docker-compose file - maybe it will help someone else:
```auto
version: "2.4"
services:
filebeat:
entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'
image: docker.elastic.co/beats/filebeat:7.9.2
container_name: filebeat
environment:
- publish-all
user: root
# command: ["--strict.perms=false"]
volumes:
- "./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
- "/proc:/hostfs/proc:ro"
- "/:/hostfs:ro"
- "/srv/filebeat/config:/usr/share/filebeat/config"
network_mode: "host"
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 31, 2021, 8:59pm UTC](https://discuss.elastic.co/t/filebeat-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/265927/9 "2021-03-31T20:59:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.