Running Filebeat on Dockeredit

Docker images for Filebeat are available from the Elastic Docker registry. You can retrieve an image with a docker pull command.

docker pull docker.elastic.co/beats/filebeat:6.3.1

The base image is centos:7 and the source code can be found on GitHub.

Configure Filebeat on Dockeredit

The Docker image provides several methods for configuring Filebeat. The conventional approach is to provide a configuration file via a bind mount, but it’s also possible to create a custom image with your configuration included.

Bind-mounted configurationedit

One way to configure Filebeat on Docker is to provide filebeat.yml via a bind mount. With docker run, the bind mount can be specified like this:

docker run \
  --mount type=bind,source="$(pwd)"/filebeat.yml,target=/usr/share/filebeat/filebeat.yml \
  docker.elastic.co/beats/filebeat:6.3.1
Custom image configurationedit

It’s possible to embed your Filebeat configuration in a custom image. Here is an example Dockerfile to achieve this:

FROM docker.elastic.co/beats/filebeat:6.3.1
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chown filebeat /usr/share/filebeat/filebeat.yml
USER filebeat