Running Filebeat on Dockeredit

Docker images for Filebeat are available from the Elastic Docker registry. You can retrieve an image with a docker pull command.

docker pull docker.elastic.co/beats/filebeat:5.6.3

The base image is centos:7 and the source code can be found on GitHub.

Configuring Filebeat on Dockeredit

The Docker image provides several methods for configuring Filebeat. The conventional approach is to provide a configuration file via a bind-mounted volume, but it’s also possible to create a custom image with your configuration included.

Bind-Mounted Configurationedit

One way to configure Filebeat on Docker is to provide filebeat.yml via bind-mounting. With docker run, the bind-mount can be specified like this:

docker run \
  -v ~/filebeat.yml:/usr/share/filebeat/filebeat.yml \
  docker.elastic.co/beats/filebeat:5.6.3

Custom Image Configurationedit

It’s possible to embed your Filebeat configuration in a custom image. Here is an example Dockerfile to achieve this:

FROM docker.elastic.co/beats/filebeat:5.6.3
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chown filebeat /usr/share/filebeat/filebeat.yml
USER filebeat