Metricbeat in container - missing docker logs

[ncasaux (Nicolas)]

Hello,

I followed the steps described in the documentation https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-docker.html and it works great!

The only issue I have is that the command "docker logs " does not show any log. It seems that this appears because of the -system.hostfs=/hostfs parameter.

Is it a normal behaviour ? Sorry if it's an obvious topic...
Thanks in advance.

[jsoriano (Jaime Soriano)]

Hi @ncasaux and welcome

I don't think this has any relationship with -system.hostfs parameter.
docker logs only shows the logs printed to standard output/error, metricbeat logs to file by default, this is something that can be changed by config, but in your case you probably have enough with using the -e parameter (after -system.hostfs=/hostfs) that makes metricbeat to log to standard error ignoring other logging outputs.

[ncasaux (Nicolas)]

Hi @jsoriano,

Thanks for your reply. Let me elaborate why I mentionned this parameter:

When I run :
docker run --mount type=bind,source=/proc,target=/hostfs/proc,readonly --mount type=bind,source=/sys/fs/cgroup,target=/hostfs/sys/fs/cgroup,readonly --mount type=bind,source=/,target=/hostfs,readonly --net=host docker.elastic.co/beats/metricbeat:6.4.0
I have the logs in the console.

When I run:
docker run --mount type=bind,source=/proc,target=/hostfs/proc,readonly --mount type=bind,source=/sys/fs/cgroup,target=/hostfs/sys/fs/cgroup,readonly --mount type=bind,source=/,target=/hostfs,readonly --net=host docker.elastic.co/beats/metricbeat:6.4.0 -system.hostfs=/hostfs
I do NOT have the logs in the console.

As you can see, the system.hostfs=/hostfs is the only difference in the command.

[jsoriano (Jaime Soriano)]

Oh, I see. The thing is that -e parameter is passed to metricbeat by default. If you set other parameters they are used instead, so if you want to keep the logs this way you need to add -e too:

docker run \
  --mount type=bind,source=/proc,target=/hostfs/proc,readonly \
  --mount type=bind,source=/sys/fs/cgroup,target=/hostfs/sys/fs/cgroup,readonly \
  --mount type=bind,source=/,target=/hostfs,readonly --net=host \
  docker.elastic.co/beats/metricbeat:6.4.0 -e -system.hostfs=/hostfs

[ncasaux (Nicolas)]

Thanks @jsoriano,I see what you mean.

Do you know how to combine -e and -system.hostfs=/hostfs in a compose file V3?
I tried many combinations, with no success so far:

So far the command part looks like this, and the container starts successfully:
command:
- "--system.hostfs=/hostfs"

This does not work:
command:
- "-e --system.hostfs=/hostfs"

It says: Error: unknown flag: --e --system.hostfs

Any idea on what's wrong with this "command" field in my yml ?

Thanks in advance.

[jsoriano (Jaime Soriano)]

In compose, the command is a list of arguments, and each argument has to be declared as a different item, one per line, i.e:

command:
- '-e'
- '--system.hostfs=/hostfs'

Or:

command: ['-e', '--system.hostfs=/hostfs']

[ncasaux (Nicolas)]

Thanks a lot @jsoriano, it works as expected!

I was doing...

command:
- ['-e', '--system.hostfs=/hostfs']