I've been building filebeat for alpine to run as a sidecar to other containers (specifically for shipping traefik access logs) and I have to say that the build process is overcomplicated with dependencies all over the place and impossible to run in docker-in-docker.
I created a more streamlined build however I have no idea if any modules except traefik and standard inputs really work. Especially since I'm running as user "nobody". But maybe it can help someone...
If anyone want to try it out the images are at
and the source can be found at
This is roughly how I use it with traefik helm chart:
... deployment: additionalContainers: - name: filebeat-traefik image: mrnr91/filebeat-alpine:v7.10.1 imagePullPolicy: Always args: ["--modules","traefik","-M", "traefik.access.var.paths=[/tmp/access.log]"] env: - name: ELASTICSEARCH_HOSTS value: es.svc.local:9200 volumeMounts: - name: tmp mountPath: /tmp ... additionalArguments: - "--accesslog=true" - "--accesslog.filepath=/tmp/access.log" ...