Metricbeat inside docker provides correct Total CPU/RAM, but incorrect process top N

[Dmitriy_Baskakov (Dmitry Baskakov)]

I run metricbeat 6.5.4 inside docker container using docker-compose.
I use default configuration from docs:

  metricbeat:
    image: docker.elastic.co/beats/metricbeat:6.5.4
    network_mode: host
    user: root
    volumes:
      - /proc:/hostfs/proc:ro
      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
      - /:/hostfs:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    secrets:
      - source: metricbeat.yml
        target: /usr/share/metricbeat/metricbeat.yml
    command:
      - "-system.hostfs=/hostfs"
    restart: unless-stopped
secrets:
  metricbeat.yml:
    file: /etc/beats/metricbeat.yml

I use following metricbeat.yml configuration:

metricbeat.modules:
- module: system
  period: 10s
  metricsets:
    - cpu
    - load
    - memory
    - network
    - process
    - process_summary
  cpu.metrics: [percentages, normalized_percentages]
  process.include_top_n:
    by_cpu: 5      # include top 5 processes by CPU
    by_memory: 5   # include top 5 processes by memory

In Kibana dashboard, I get almost everything correct: total values for CPU/RAM, time histogram for CPU/RAM, network usage. But the only thing which is incorrect: top 5 processes by CPU/RAM.

For example: I have 86% RAM usage, total gauge, and time histogram gauge shows the same, when I SSH into server - I see this same correct values. But top 5 processes by RAM shows minimal usage 0-1% with "metricbeat" process at the top - which shows that metricbeat gets TOP process from inside the container, not from the host top.

Please, provide an advice how to solve this. I was not able to find it in existing topics. I appreciate your help.