Hello Everyone,
I'm trying to follow the "Getting started with the Elastic Stack and Docker Compose" blog guide. (I'm not allowed to post the actual URL.) I'm running into an issue following the directions and I'm hoping someone can tell me where I'm going wrong.
I'm using Portainer CE 2.21.3 to manage the stack and docker is running on Ubuntu 24.04. Following docker recommendations, it was not installed using the Ubuntu modules.
I have been following the guide exactly and other than the install specific variables (like password), I only changed the stack version variable. Set to 8.15.3 from 8.7.1.
Everything goes smooth until I get to the section on metricbeat. When I redeploy the stack after adding that section to the config, I get the following error.
Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "/data/compose/14/metricbeat.yml" to rootfs at "/usr/share/metricbeat/metricbeat.yml": create mount destination for /usr/share/metricbeat/metricbeat.yml mount: cannot mkdir in /var/lib/docker/overlay2/b9264bedf1fe6fb73f06245f0dc6d03807a860e053f0cfaca07747e790a60cc5/merged/usr/share/metricbeat/metricbeat.yml: not a directory: unknown: Are you trying to mount a directory onto a file (or vice-versa)? Check if the specified host path exists and is the expected type
I checked the file system and the files are created as directories. The "Bind mounts" docs page says this is expected behavior when using -v or --volume. I am able to side-step this by deleting the metricbeat.yml folder and manually creating metricbeat.yml then adding the config info to it. After this monitoring data is in Elastic as the next step of the guide says.
The error happens again when I do the filebeat section. I can side-step this error the same way but when I look in Elastic there is no data. I added a sample.log file to data/compose/14 /filebeat_ingest_data/ but when I go to observability>logs>stream I get the "Welcome blah blah... add a logging integration" message page.
Currently, the stack starts without an error but I noticed a few seconds after starting, both the filebeat and metricbeat containers have a status of "Exited Code 1"
My two questions are:
What am I doing wrong that is causing the error in the first place?
What am I doing wrong with filebeat?
Sorry for the very long post and thank you for reading.
Is that the correct path where your metricbeat.yml is.
Did you check that all the permissions from the root directory down to that metricbeat.yml
Also you can try to put the full path here instead of relative...when I see that where it creates the file as a directory it's when it can't be found or where there's a permission issue reaching that file
I guess I need to read up more on Portainer because I'm not really sure. I'm using Portainer and have no ideal how to tell it / give it the .yml files to use for filebeat/metricbeat or where to put those files. I can say that none of the files existed on the host prior to deploying the stack in Portainer. I found /data/compose/14/ in the error message and have been making changes there.
The output of ls -ld shows root as the owner for the entire directory path and the files. I believe this is what docker wants.
First let me say, I'm not very good with Linux. I'm also new to both portainer and docker. I'm not sure what the full path should be. I tried replicating where it wanted to put the file in the container. /usr/share/metricbeat/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
I created the directories and files first with root as the owner. This ended in a similar error.
I then changed it to the /data/compose/14 directory and it seems to be working now. (Root is owner of these directories.) I now see the data from my sample.log file in data>stream as the guide shows.
Thank you for your help!
Two more questions if you don't mind.
In the compose file, is ./metricbeat.yml: asking me where I put the files on the docker host? (Based on what I've learned from this, I think that is the case but want to be sure.)
And if so, is there a recommended location I should be putting these files?
Side note for other noobs: I had spacing errors in my metricbeat and filebeat YML files and that was the cause of the containers "exited code 1" status. Checking the container logs in Portainer will tell you what line the error is on.
Relative paths can be tricky because sometimes processes start up from their own directory. So I'm not a huge fan of relative paths. I would rather use absolute paths.. if there's any confusion.
I would say continue to learn more about Linux, we can help you a bit but there is an assumption that you have a basic working knowledge of the OS you are working with.
You can put any of this anywhere you want. Just need to understand your own directory structure and its own permissions and where we want the files, data etc.
Thank you for the reply.
I now understand my initial mistake. Since I was using Portainer's web interface from a different system, I wasn't looking at the guide in terms of "from the command line" and I failed to realize I needed to copy the files to the docker host first.
I thought Portainer would give me a chance to upload or create the other .yml files the way it lets me upload or create the docker-compose.yml. Had I been doing this at the command line it would have been "no duh, I need to copy the files over and use that path".
Thank you again for helping me through my very obvious logic breakdown. LoL
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.