How to properly launch filebeat in container?

Elastic Stack Beats
,
1

Hello!
I launched filebeat in container like advised in this link: www.elastic.co
But filebeat doesn't send my logs to remote host.

It seems the provided dockerfile is incorrect, entrypoint is absent. Is it?
I modified it a little bit:

FROM docker.elastic.co/beats/filebeat:7.6.0
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chown root:filebeat /usr/share/filebeat/filebeat.yml
RUN chmod go-w /usr/share/filebeat/filebeat.yml
USER filebeat

filebeat.yml:

###################### Filebeat Configuration #########################
#=========================== Filebeat inputs =============================
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log
#==================== Elasticsearch template setting ==========================
setup.template.enabled: true
setup.template.name: "foo"
setup.template.pattern: "foo-*"
setup.template.overwrite: true

output.elasticsearch:
  hosts: '${ES_HOSTS:?Elasticsearch ip is not defined.}'
  index: "foo-%{[agent.version]}-%{+yyyy.MM.dd}"
  username: "filebeat"
  password: "filebeat"

Built the image, created sample logs and launched it:

docker run -e ES_HOSTS="*some_host:some_port*" -v "/var/logs/foo-service:/var/log" filebeat

But logs aren't processed, filebeat doesn't output anything.

What is wrong?
Perhaps Dockerfile is incorrect?

Also, I have the following configs in filebeat.yml: setup.template. It performs index creation based on template name, would the index be automatically created?

2

Hi!

Could you make sure that the path you configure is valid?

This part

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log

should match the log file you want to collect from for instance: /var/log/foo.log

Reference: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#input-paths

Regards.

3

I checked path. Its valid. I run docker exec -it 123a bash and checked this folder, its full of logs

Could you please also answer other questions.

4

@vlopp, check if filebeat is connecting to ealsticsearch

docker exec -it filebeat ./filebeat test output

Raj

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.