When I start your container I get :
modules.go:95: ERR Not loading modules. Module directory not found: /module

Any ideas ?

It would be great if it were possible to offer a docker image based on the alpha/beta releases of Filebeat for testing/playing with. vs. forking.

thanks for this image!

I am hoping to get some clarification on best use case for this image.

When I start the filebeat container, my yaml file says to look at the syslogs and ship them to logstash. In order to get the logs from my other containers, I have them logging to the host syslog, and then I mount the host syslog file to the filebeat container so it can have access to all the logs.

Here's an image to hopefully do a better job of showing what my setup is like 🙃

This works when I first start the filebeat container, but after several hours it stops shipping the logs to logstash. I'm trying to debug the issue but filebeat itself isn't outputting any error messages. It appears that the mounted syslog file is simply no longer getting any logs from the host machine. This is leading me to believe that I may not be using the image correctly.

Could you please provide an example use case? Possibly add it to the README.

I'm seeing the following when running this with my own filebeat.yml file:
Exiting: error loading config file: config file ("filebeat.yml") must be owned by the beat user (uid=0) or root

This works fine when I'm running docker for mac, but I get the error on linux.

We're looking to switch from digital-wonderland/docker-logstash-forwarder. It has a nice feature that it listens to docker events and automatically refreshes the files it's looking at (which is mounted from /var/lib/docker from the host) when a container is created/deleted.

Is this supported in docker-filebeat too?

After run:
docker run -v /path/to/filebeat.yml:/filebeat.yml prima/filebeat:1

I got this:

Loading config file error: Failed to read /filebeat.yml: read /filebeat.yml: is a directory. Exiting.

I change filebeat to 6.1.1 in your Dockerfile,and want to build it,but failed.Would you mind uprade filebeat to 6.1.1?Thank you very much.

In my Docker run, I created a Docker volume from the data folder:
-v filebeatData:/data

When restarting, filebeat detects the data/registry file. I get this in the console:

2017/02/27 10:39:59.052887 beat.go:207: INFO filebeat start running. 2017/02/27 10:39:59.054510 registrar.go:85: INFO Registry file set to: /data/registry 2017/02/27 10:39:59.055889 registrar.go:106: INFO Loading registrar data from /data/registry 2017/02/27 10:39:59.057644 registrar.go:123: INFO States Loaded from registrar: 2 2017/02/27 10:39:59.058042 crawler.go:34: INFO Loading Prospectors: 1 2017/02/27 10:39:59.058362 prospector_log.go:57: INFO Prospector with previous states loaded: 0

However, during the restart, filebeat still sends all the logs previously sent to my ELK container:

This is my filebeat.yml:

This does not happen when I run filebeat on the host. Filebeat will only send the logs that it has not sent since the restart. Has anyone faced the same issue?

Following your run instruction,

docker@default:~$ docker run -v /<host>/filebeat.yml:/filebeat.yml prima/filebeat
2017/02/20 19:20:11.737857 beat.go:267: INFO Home path: [/] Config path: [/] Data path: [//data] Logs path: [//logs]
2017/02/20 19:20:11.738035 beat.go:177: INFO Setup Beat: filebeat; Version: 5.2.1
2017/02/20 19:20:11.738143 output.go:167: INFO Loading template enabled. Reading template file: /filebeat.template.json
2017/02/20 19:20:11.738197 outputs.go:100: ERR failed to initialize elasticsearch plugin as output: Error loading template /filebeat.template.json: open /filebeat.template.json: no suc
h file or directory
2017/02/20 19:20:11.738227 beat.go:288: CRIT Exiting: error initializing publisher: Error loading template /filebeat.template.json: open /filebeat.template.json: no such file or direct
ory
Exiting: error initializing publisher: Error loading template /filebeat.template.json: open /filebeat.template.json: no such file or directory
docker@default:~$

Hello,primait:
I use your docker image prima/filebeat:5.0.1 to work with sebp/elk .Everything is well untill yesterday the filebeat had the error : " single.go:140: ERR Connecting error publishing events (retrying): dial tcp elk server ip : 5044: i/o timeout" .And this error I have traced for long time , noting is effective . Maybe you can give me more information to investigate this error .
Thank you very much ~