Trying to start filebeat from container

Elastic Stack Beats
,
2

Hi!

You are right that when you are starting the container the entrypoint command is running filebeat, so this why you cannot start a second instance.

So now regarding the permission issue. This is what I see using your docker-compose.yml:

[root@75a00dcfa617 filebeat]# ls -l filebeat.yml 
-rw-r--r-- 1 root root 8345 Feb 24 15:19 filebeat.yml

and on the host:

ls -l  
-rw-r--r--  1 chrismark  staff  1596 Feb 24 16:27 docker-compose.yml
-rw-r--r--  1 chrismark  staff  8345 Feb 24 17:19 filebeat.yml

In this, I'm able to start the whole stack normally.

In order to provide an idea on the workaround you have found maybe you can try mounting a second configuration file like:

- "./filebeat.yml:/usr/share/filebeat/filebeat2.yml"

and override the container's entry command like:

  filebeat:
    depends_on:
      - "elasticsearch"
    image: docker.elastic.co/beats/filebeat:7.6.0
    container_name: filebeat
    user: root
    command: ./filebeat -e -c filebeat2.yml
    volumes:
      - "./filebeat.yml:/usr/share/filebeat/filebeat2.yml"
      - "./test.json:/usr/share/filebeat/sample.json"
      - "/var/lib/docker/containers:/usr/share/filebeat/dockerlogs:ro"
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - filebeat
    networks:
      - elastic-net