- 5.2, 5.2.1, latest (5.2/Dockerfile)
- 1.2 (1.2/Dockerfile)
Run the latest container with:
docker run stakater/filebeat:latest
Build an image:
docker build -t stakater/filebeat .
Push an image:
sudo docker push stakater/filebeat
Note you might have to login first before you can push the image to docker-hub sudo docker login
Before starting Filebeat
, you should look at the configuration options in the configuration file, for example /etc/filebeat/filebeat.yml
Tell filebeat container three things:
- location (directory) containing logs to beat
- logstash server host
- logstash server port
e.g.
docker run -d -v "/Users/rasheed/Documents/projects/pliro/ams/logs:/var/log/app" -e "LOGSTASH_HOST=192.168.99.100" -e "LOGSTASH_PORT=5044" stakater/filebeat
To run filebeat with full debug logs...
/usr/bin/filebeat -e -d "*" -c /etc/filebeat/filebeat.yml
filebeat
logs can be found at: /var/log/mybeat/mybeat
and level can be changed in filebeat.yml
Before starting Filebeat for the first time, run this command (replace ELASTIC_SEARCH_HOST with the appropriate hostname) to load the default index template in Elasticsearch:
curl -XPUT 'http://{ELASTIC_SEARCH_HOST}:9200/_template/filebeat?pretty' -d@/{PATH_TO_THIS_FILE}/filebeat.template.json
And the response should be:
{
"acknowledged" : true
}