# Run metricbeat in docker

**URL:** <https://discuss.elastic.co/t/run-metricbeat-in-docker/148522>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [September 13, 2018, 9:54pm UTC](https://discuss.elastic.co/t/run-metricbeat-in-docker/148522 "2018-09-13T21:54:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bertolis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bertolis/32/35522_2.png) [@bertolis](https://discuss.elastic.co/u/bertolis)\
**Post date:** [September 13, 2018, 9:54pm UTC](https://discuss.elastic.co/t/run-metricbeat-in-docker/148522/1 "2018-09-13T21:54:42Z")

</div>

Hi, i am running elk with docker-compose, i get status green in elasticsearch and i can also login to kibana.  
When i run "sudo ./metricbeat -e -c metricbeat.yml" from the tar.gz i downloaded, i get an index in elasticsearch and i can import the dashboard in kibana. The problem is when i try to run metricbeat with docker, no index is created and i get this error in logs:

"ERROR pipeline/output.go:91 Failed to connect: Get [http://elasticsearch:9200](http://elasticsearch:9200): lookup elasticsearch on 127.0.0.11:53: no such host".

Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 14, 2018, 12:44am UTC](https://discuss.elastic.co/t/run-metricbeat-in-docker/148522/2 "2018-09-14T00:44:32Z")

</div>

I'm no docker expert, but it looks like it's trying to resolve the hostname `elasticsearch` via local lookup and it cannot.

Where does Elasticsearch run?

---

<div class="post-metadata">

**Author:** ![bertolis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bertolis/32/35522_2.png) [@bertolis](https://discuss.elastic.co/u/bertolis)\
**Post date:** [September 14, 2018, 8:41am UTC](https://discuss.elastic.co/t/run-metricbeat-in-docker/148522/3 "2018-09-14T08:41:20Z")

</div>

I do "docker-compose up" from this elk stack i downloaded:

> **[deviantony/docker-elk](https://github.com/deviantony/docker-elk)**
>
> The ELK stack powered by Docker and Compose. Contribute to deviantony/docker-elk development by creating an account on GitHub.

And then in another directory, i have a Dockerfile, a metricbeat.yml and a docker-compose.yml and i do "docker-compose up" as well.

Here are my files for metricbeat:

# Dockerfile

```
FROM docker.elastic.co/beats/metricbeat:6.4.0
COPY metricbeat.yml /usr/share/metricbeat/metricbeat.yml
USER root 
RUN chown root /usr/share/metricbeat/metricbeat.yml

```

# docker-compose.yml

```
version: "3.6"

services:
  metricbeat:
    build: .
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: -e 
    user: root

```

# metricbeat.yml

```
#========================== Modules configuration ============================

metricbeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  #_source.enabled: false

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
```

---

<div class="post-metadata">

**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\
**Post date:** [September 14, 2018, 1:00pm UTC](https://discuss.elastic.co/t/run-metricbeat-in-docker/148522/4 "2018-09-14T13:00:30Z")

</div>

In deviantony's Compose file, Elasticsearch is [running in a dedicated network called "elk"](https://github.com/deviantony/docker-elk/blob/f286c5bc92db175a57fa6727f2a1847717699daa/docker-compose.yml#L17-L18). When you `docker-compose up`, Docker will create a network named $DIR\_elk, where $DIR is your current directory. On my system, I'm in a directory called `tmp`, so:

```auto
$ docker network list
NETWORK ID NAME DRIVER SCOPE
9718f7a3939d bridge bridge local
c9385469dfc3 host host local
5c51cc95c6a9 none null local
efbd40c66d2c tmp_elk bridge local

```

You need to arrange for your Metricbeat container to be in that network too, so that it can resolve the hostname `elasticsearch` and reach the Elasticsearch container on port 9200.

---

<div class="post-metadata">

**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\
**Post date:** [September 14, 2018, 1:13pm UTC](https://discuss.elastic.co/t/run-metricbeat-in-docker/148522/5 "2018-09-14T13:13:46Z")

</div>

Alternatively, you could map port 9200 from the Elasticsearch container to the host system, which the stack Compose also [seems to do](https://github.com/deviantony/docker-elk/blob/f286c5bc92db175a57fa6727f2a1847717699daa/docker-compose.yml#L13) and then connect Metricbeat to the host network with `network_mode: host`.

With this approach, Metricbeat can be configured to talk to `localhost` (like you have now), because `localhost` is now the actual host machine and Elasticsearch has been bound to port 9200 on the host.

In your current configuration, `localhost` is just the Metricbeat container, so it's trying to talk to itself.

---

<div class="post-metadata">

**Author:** ![bertolis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bertolis/32/35522_2.png) [@bertolis](https://discuss.elastic.co/u/bertolis)\
**Post date:** [September 21, 2018, 4:08pm UTC](https://discuss.elastic.co/t/run-metricbeat-in-docker/148522/6 "2018-09-21T16:08:38Z")

</div>

> [@bertolis](#):
>
> bea

It works perfectly after i specified the remote network. However i did it using docker stack, i couldn't make it work with docker compose for some reason. Anyway it is now working. Thanks a lot for helping me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2018, 4:08pm UTC](https://discuss.elastic.co/t/run-metricbeat-in-docker/148522/7 "2018-10-19T16:08:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.