# Secured beats in a docker container
**URL:** https://discuss.elastic.co/t/secured-beats-in-a-docker-container/265682
**Category:** Beats
**Tags:** elastic-stack-security, docker, metricbeat
**Created:** [February 27, 2021, 6:32am UTC](https://discuss.elastic.co/t/secured-beats-in-a-docker-container/265682 "2021-02-27T06:32:26Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@smm](https://discuss.elastic.co/u/smm)
#### Post date: [February 27, 2021, 6:32am UTC](https://discuss.elastic.co/t/secured-beats-in-a-docker-container/265682/1 "2021-02-27T06:32:26Z")
Hi there,
how is the approach to create a secured metricbeat docker container to send data to a secured elastick stack?
Background:
I have a secured stack, with self signed certificate authority in place.
Now I would like to have a metricbeat that also uses this CA and sends data securely to the stack.
Technicall it goes like this (metricbaet.docker.yml):
...
output.elasticsearch:
enabled: true
protocol: "https"
hosts: '${ELASTICSEARCH\_HOSTS:elasticsearch:9200}'
# CA certificate
ssl.certificate\_authorities: ["/usr/share/ca/ca.crt"]
ssl.certificate: "/usr/share/instance/instance.crt"
ssl.key: "/usr/share/instance/instance.key"
username: '{ELASTICSEARCH\_USERNAME:}' password: '{ELASTICSEARCH\_PASSWORD:}'
AND:
This is how I would create an instance certificate if not in a docker environment:
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca-cert /usr/share/elasticsearch/ca/ca.crt --ca-key /usr/share/elasticsearch/ca/ca.key --ip 192.168.56.112 --pem
But how I do create in a docker instance a certificate since:
a) I do not know the IP, since the container is volatile - perhpas an IP range? Possible?
Since docker IPs are not fixed, can I (running on Ubuntu 20.04) build some 'general', not ip fixed docker certificates?
b) In a metricbet container I do not have a elasticsearch-certutil?
Does someone has a working / step-by-step solution for this case?
This is not documented in the elastic docs so far.
kind regards and big thanks
Stefano
---
### Author:  [@smm](https://discuss.elastic.co/u/smm)
#### Post date: [February 27, 2021, 7:21am UTC](https://discuss.elastic.co/t/secured-beats-in-a-docker-container/265682/2 "2021-02-27T07:21:19Z")
It works now - I got it.
docker run
--rm
--net host
--name=metricbeat
--user=root
--volume="(pwd)/metricbeat.docker.yml:/usr/share/metricbeat/metricbeat.yml:ro" \ --volume="(pwd)/ca/ca.crt:/usr/share/metricbeat/ca.crt:ro"
--volume="(pwd)/instance/instance.crt:/usr/share/metricbeat/instance.crt:ro" \ --volume="(pwd)/instance/instance.key:/usr/share/metricbeat/instance.key:ro"
--volume="/var/run/docker.sock:/var/run/docker.sock:ro"
--volume="/sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro"
--volume="/proc:/hostfs/proc:ro"
--volume="/:/hostfs:ro"
[docker.elastic.co/beats/metricbeat:7.8.1](http://docker.elastic.co/beats/metricbeat:7.8.1) metricbeat --strict.perms=false -e
-E output.elasticsearch.hosts=["[https://192.168.56.112:9200](https://192.168.56.112:9200)"]
-E output.elasticsearch.username=elastic
-E output.elasticsearch.password=password
# metricbeat.docker.yml
....
output.elasticsearch:
enabled: true
protocol: "https"
hosts: '${ELASTICSEARCH\_HOSTS:elasticsearch:9200}'
# CA certificate
ssl.certificate\_authorities: ["/usr/share/metricbeat/ca.crt"]
ssl.certificate: "/usr/share/metricbeat/instance.crt"
ssl.key: "/usr/share/metricbeat/instance.key"
username: '{ELASTICSEARCH\_USERNAME:}' password: '{ELASTICSEARCH\_PASSWORD:}'
AND for the docker container:
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca-cert /usr/share/elasticsearch/ca/ca.crt --ca-key /usr/share/elasticsearch/ca/ca.key --pem
cheers
Stefano
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2021, 9:22am UTC](https://discuss.elastic.co/t/secured-beats-in-a-docker-container/265682/3 "2021-03-27T09:22:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.