# Trying to start filebeat from container

**URL:** <https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [February 24, 2020, 1:47pm UTC](https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664 "2020-02-24T13:47:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![zebulyon](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zebulyon](https://discuss.elastic.co/u/zebulyon)\
**Post date:** [February 24, 2020, 1:47pm UTC](https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664/1 "2020-02-24T13:47:13Z")

</div>

Hello I am currently unable of properly starting my filebeat process from its container.

My probelm is that when I try to run it filebeat will imidietly exit and give me this error response:  
`Exiting: error loading config file: config file ("filebeat.yml") must be owned by the user identifier (uid=0) or root`

The problem seem to be that when using the volume command  
`- ./filebeat.yml:/usr/share/filebeat/filebeat.yml"`  
The file in question is assigned some weird permission and locks me out from accessing it even though I have set the user in the container to root.

When checking the permission through the command `ls -l filebeat.yml` on the host computer I get: `-rwxrwxrwx 1 zebul zebul 464 Feb 24 13:29 filebeat.yml` so everyone should be allowed access to it. Even when I go into the container it says that everyone should have access to it  
`-rwxrwxrwx 1 filebeat filebeat 464 Feb 24 13:17 filebeat.yml`

And before it is suggested I have tried to use chmod, and chown commands to try and change the permission of the file within the filebeat.yml container but I am denied the ability to do it.

I have managed to found a work around to this problem by removing the command  
`- ./filebeat.yml:/usr/share/filebeat/filebeat.yml"` from the docker-compose file then go into the docker container for filebeat, at this point I have full access to the base filebeat.yml, which when using the `ls -l filebeat.yml` command give me this response  
`-rw-r----- 1 root filebeat 315 Feb 5 23:09 filebeat.yml`,  
This filebeat.yml file comes with the container and be modified it but then I run into another problem, which is that when i try to execute filebeat I get the response  
`Exiting: data path already locked by another beat`.

![2020-24](https://us1.discourse-cdn.com/elastic/original/3X/7/0/70e167ecf5b73c62afc40893a3f7963adf14c2ba.png)

To my knowledge I am only running a single instance of beat which is the filebeat instance, I can only assume that I get this because I use the docker-compose to create the container from the image, but because I can't give it the correct filebeat.yml file right away I have to then use the command `docker exec -it filebeat bash` to get access to bash within the filebeat container. My assumption is thus that when using the `docker exec` command I am creating another instance of the filebeat container.

This is the docker-compose file I am using for starting the ELK-stack.

```
    version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.6.0
    container_name: elasticsearch
    environment:
      #- cluster.name=elastic-cluster
      #- bootstrap.memory_lock=true # along with the memlock settings below, disables swapping
      #- "ES_JAVA_OPTS=-Xms512m -Xmx512m" # minimum and maximum Java heap size, recommend setting both to 50% of system RAM
       - "discovery.type=single-node"
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
      memlock:
        soft: -1
        hard: -1
    volumes:
      - elastic-data:/usr/share/elasticsearch/data
    ports:
      - 9200:9200
      - 9600:9600 # required for Performance Analyzer
    expose:
      - "9200"
    networks:
      - elastic-net
  kibana:
    depends_on:      
      - "elasticsearch"
    image: docker.elastic.co/kibana/kibana:7.6.0
    container_name: kibana
    ports:
      - 5601:5601
    expose:
      - "5601"
    environment:
      ELASTICSEARCH_URL: http://elasticsearch:9200
    networks:
      - elastic-net
  filebeat:
    depends_on:
      - "elasticsearch"
    image: docker.elastic.co/beats/filebeat:7.6.0
    container_name: filebeat
    user: root
    volumes:
      - "./filebeat.yml:/usr/share/filebeat/filebeat.yml"
      - "./test.json:/usr/share/filebeat/sample.json"
      - "/var/lib/docker/containers:/usr/share/filebeat/dockerlogs:ro"
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - filebeat
    networks:
      - elastic-net

volumes:
  elastic-data:

networks:
  elastic-net:
    driver: bridge

```

For the entirety of the ELK-stack I am using the docker images version 7.6.0

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [February 24, 2020, 3:37pm UTC](https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664/2 "2020-02-24T15:37:07Z")

</div>

Hi!

You are right that when you are starting the container the entrypoint command is running filebeat, so this why you cannot start a second instance.

So now regarding the permission issue. This is what I see using your `docker-compose.yml`:

```auto
[root@75a00dcfa617 filebeat]# ls -l filebeat.yml 
-rw-r--r-- 1 root root 8345 Feb 24 15:19 filebeat.yml

```

and on the host:

```auto
ls -l  
-rw-r--r-- 1 chrismark staff 1596 Feb 24 16:27 docker-compose.yml
-rw-r--r-- 1 chrismark staff 8345 Feb 24 17:19 filebeat.yml

```

In this, I'm able to start the whole stack normally.

In order to provide an idea on the workaround you have found maybe you can try mounting a second configuration file like:

`- "./filebeat.yml:/usr/share/filebeat/filebeat2.yml"`

and override the container's entry command like:

```auto
  filebeat:
    depends_on:
      - "elasticsearch"
    image: docker.elastic.co/beats/filebeat:7.6.0
    container_name: filebeat
    user: root
    command: ./filebeat -e -c filebeat2.yml
    volumes:
      - "./filebeat.yml:/usr/share/filebeat/filebeat2.yml"
      - "./test.json:/usr/share/filebeat/sample.json"
      - "/var/lib/docker/containers:/usr/share/filebeat/dockerlogs:ro"
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - filebeat
    networks:
      - elastic-net

```

---

<div class="post-metadata">

**Author:** ![zebulyon](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zebulyon](https://discuss.elastic.co/u/zebulyon)\
**Post date:** [February 24, 2020, 6:12pm UTC](https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664/3 "2020-02-24T18:12:07Z")

</div>

Hello, thanks for the quick response, as well as confirming my suspicions regarding the creation of a second instance.

I am however very confused as to why you can start the whole stack normally. As I truly am unable to get it to work.

![Selection_004](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ff4d0d1839acbce3fc1cc63fd5ec5dc66e0a83ed.png)

 ![Selection_008](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e581a9645f76ad32530b85589cd974cb07d131fa.png)

I have now tried your solution in regards to my work around but that also fails, and I seem to get the exact same error message as before. I have tried to add your suggestion regarding the work around both in the normal `docker-compose` file and in the `docker-compose.override.yml` file but I still get the same old result.

 ![Selection_005](https://us1.discourse-cdn.com/elastic/original/3X/3/9/3918ec7c76cff890718881fd003f97e3924f144b.png)  
 ![Selection_006](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e2a6e5766c33f70aabeca08484b8e32b91bf8455.png)  
 ![Selection_009](https://us1.discourse-cdn.com/elastic/original/3X/5/0/5061123b2956b8e7b8739c8b4d2c5ad3380d957a.png)

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [February 25, 2020, 11:33am UTC](https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664/4 "2020-02-25T11:33:56Z")

</div>

Hmm,

I see that in my case it is like this in the container:

```auto
[root@75a00dcfa617 filebeat]# ls -l filebeat.yml 
-rw-r--r-- 1 root root 8345 Feb 24 15:19 filebeat.yml

```

I would say that it is different because we run `docker-compose` differently (users, permissions etc) so this is why in my case works.

So can you fix the ownerships the files accordingly? What the error message indicates is that the configuration file should be owned by `root` (I guess that uid=0 is would also be `root`).

---

<div class="post-metadata">

**Author:** ![zebulyon](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zebulyon](https://discuss.elastic.co/u/zebulyon)\
**Post date:** [February 25, 2020, 12:26pm UTC](https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664/5 "2020-02-25T12:26:35Z")

</div>

I think that might be the solution.  
Because when I create the filebeat.yml file as root, thus setting root as the owner of the file on the host computer, then the previous error  
,`Exiting: error loading config file: config file ("filebeat.yml") must be owned by the user identifier (uid=0) or root` ,  
seem to disappear. And no new error seems to have appeared either.

Could you also tell me how check to see if everything is working as intended?

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [February 25, 2020, 4:34pm UTC](https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664/6 "2020-02-25T16:34:27Z")

</div>

If Filebeat is able to start then you have solved the configuration's permission related issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2020, 4:34pm UTC](https://discuss.elastic.co/t/trying-to-start-filebeat-from-container/220664/7 "2020-03-24T16:34:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.