Hi Andrew,
I created a filebeat:6.0.0-beta2 image from a Dockerfile based on the prima/filebeat:5.6.0 one (https://hub.docker.com/r/prima/filebeat/~/dockerfile/) - I updated the Dockerfile to pull the 6.0.0-beta2 Filebeat binary and amended the SHA check etc
Then I created another Dockerfile to reference my filebeat:6.0.0-beta2 image and in that I have the following:
FROM filebeat:6.0.0-beta2
COPY filebeat.yml /filebeat.yml
RUN chmod go-w /filebeat.yml
USER root
If I then attach to the running container I can see that filebeat is being run as root. Like I said, I can see data in Kibana but just not the new metadata fields.
Steve