Running Filebeat on Docker

edit

Docker images for Filebeat are available from the Elastic Docker registry. You can retrieve an image with a docker pull command.

docker pull docker.elastic.co/beats/filebeat:6.2.4

The base image is centos:7 and the source code can be found on GitHub.

Configure Filebeat on Docker

edit

The Docker image provides several methods for configuring Filebeat. The conventional approach is to provide a configuration file via a bind mount, but it’s also possible to create a custom image with your configuration included.

Bind-mounted configuration
edit

One way to configure Filebeat on Docker is to provide filebeat.yml via a bind mount. With docker run, the bind mount can be specified like this:

docker run \
  --mount type=bind,source="$(pwd)"/filebeat.yml,target=/usr/share/filebeat/filebeat.yml \
  docker.elastic.co/beats/filebeat:6.2.4
Custom image configuration
edit

It’s possible to embed your Filebeat configuration in a custom image. Here is an example Dockerfile to achieve this:

FROM docker.elastic.co/beats/filebeat:6.2.4
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chown filebeat /usr/share/filebeat/filebeat.yml
USER filebeat