{"id":20901611,"url":"https://github.com/willfarrell/docker-filebeat","last_synced_at":"2025-05-13T03:30:49.909Z","repository":{"id":138883143,"uuid":"56002927","full_name":"willfarrell/docker-filebeat","owner":"willfarrell","description":"Docker image for Elastic Filebeat","archived":false,"fork":false,"pushed_at":"2017-10-02T15:51:37.000Z","size":36,"stargazers_count":11,"open_issues_count":4,"forks_count":9,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-01T15:47:55.951Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"isc","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/willfarrell.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-04-11T19:53:17.000Z","updated_at":"2019-03-27T11:21:59.000Z","dependencies_parsed_at":null,"dependency_job_id":"7be09352-6b7b-4c80-9d3d-b651d71182e7","html_url":"https://github.com/willfarrell/docker-filebeat","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/willfarrell%2Fdocker-filebeat","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/willfarrell%2Fdocker-filebeat/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/willfarrell%2Fdocker-filebeat/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/willfarrell%2Fdocker-filebeat/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/willfarrell","download_url":"https://codeload.github.com/willfarrell/docker-filebeat/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253867351,"owners_count":21976209,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-18T11:36:13.317Z","updated_at":"2025-05-13T03:30:49.901Z","avatar_url":"https://github.com/willfarrell.png","language":"Shell","readme":"# willfarrell/filebeat\n\n**Official Image:** https://github.com/elastic/beats-docker. Note uses `centos:7` as it's base. See [#12](https://github.com/elastic/beats-docker/issues/12)\n\n**Filebeat: Analyze Log Files in Real Time**\nGet ready for the next-generation Logstash Forwarder: Filebeat. Filebeat collects, pre-processes, and forwards log files from remote sources so they can be further enriched and combined with other data sources using Logstash. https://www.elastic.co/products/beats/filebeat\n\n- [documentation](https://www.elastic.co/guide/en/beats/filebeat/index.html)\n- [sample filebeat.yml](https://github.com/elastic/beats/blob/master/filebeat/filebeat.yml)\n\n## Supported tags and Dockerfile links\n\n-\t[`5.2.0`, `5.2`, `5`, `latest` (*Dockerfile*)](https://github.com/willfarrell/docker-filebeat/blob/master/5.2.0/Dockerfile)\n-\t[`5-stdin` (*Dockerfile*)](https://github.com/willfarrell/docker-filebeat/blob/master/5-stdin/Dockerfile)\n\n-\t[`5.1.2`, `5.1` (*Dockerfile*)](https://github.com/willfarrell/docker-filebeat/blob/master/5.1.2/Dockerfile)\n\n-\t[`1.3.0`, `1.3`, `1` (*Dockerfile*)](https://github.com/willfarrell/docker-filebeat/blob/master/1.3.0/Dockerfile)\n-\t[`1.2.3`, `1.2` (*Dockerfile*)](https://github.com/willfarrell/docker-filebeat/blob/master/1.2.3/Dockerfile)\n-\t[`1.1.2`, `1.1` (*Dockerfile*)](https://github.com/willfarrell/docker-filebeat/blob/master/1.1.2/Dockerfile)\n-\t[`1.0.1`, `1.0` (*Dockerfile*)](https://github.com/willfarrell/docker-filebeat/blob/master/1.0.1/Dockerfile)\n\n\n[![](https://images.microbadger.com/badges/version/willfarrell/filebeat.svg)](http://microbadger.com/images/willfarrell/filebeat \"Get your own version badge on microbadger.com\") [![](https://images.microbadger.com/badges/image/willfarrell/filebeat.svg)](http://microbadger.com/images/willfarrell/filebeat \"Get your own image badge on microbadger.com\")\n\n## Run Examples\n\n### ENV\n```bash\nHOSTNAME: Server Name\nLOGSTASH_HOST: Recommended name for Logstash Hostname [default=logstash]\nLOGSTASH_PORT: Recommended name for Logstash Port [default=5044]\n```\n\n### docker-cli\n```\ndocker run \\\n\t-v /path/to/filebeat.yml:/etc/filebeat/filebeat.yml \\\n\twillfarrell/filebeat:5\n```\n\n### Dockerfile\n\n```Dockerfile\nFROM willfarrell/filebeat:5\nCOPY filebeat.yml /filebeat.yml\n```\n\n### docker-compose\n\n```yml\nversion \"3\"\n\nservices:\n  filebeat:\n    image: willfarrell/filebeat:5\n    #command: \"filebeat -e -c /etc/filebeat/filebeat.yml\"\n    environment:\n      HOSTNAME: \"my-server\"\n      LOGSTASH_HOST: \"192.168.99.100\"\n      LOGSTASH_PORT: \"5044\"\n    volumes:\n     - \"./filebeat.yml:/etc/filebeat/filebeat.yml:rw\"\n\n```\n\n## stdin\nThere is also a wrapper image over the base image provided here that allows piping of docker stdout into filebeat.\n\n### ENV\n```bash\nHOSTNAME: Same as above\nLOGSTASH_HOST: Logstash Hostname [default=logstash]\nLOGSTASH_PORT: Logstash Port [default=5044]\nSTDIN_CONTAINER_LABEL: Container label to filter what containers to monitor. Set label to `true` to enable. Set ENV to `all` in ignore labels. [default=filebeat.stdin]\n```\n\n### docker-cli\n```\ndocker run \\\n\t-v /path/to/filebeat.yml:/etc/filebeat/filebeat.yml \\\n\t-v /var/run/docker.sock:/tmp/docker.sock \\\n\twillfarrell/filebeat:5-stdin\n```\n\n### Dockerfile\n\n```Dockerfile\nFROM willfarrell/filebeat:5-stdin\nCOPY filebeat.yml /filebeat.yml\n```\n\n### docker-compose\n\n```yml\nversion \"3\"\n\nservices:\n  filebeat:\n    image: willfarrell/filebeat:5-stdin\n    #command: \"filebeat -e -c /etc/filebeat/filebeat.yml\"\n    environment:\n      HOSTNAME: \"my-server\"\n      LOGSTASH_HOST: \"192.168.99.100\"\n      LOGSTASH_PORT: \"5044\"\n      STDIN_CONTAINER_LABEL: \"all\"\n    volumes:\n     - \"./filebeat.yml:/etc/filebeat/filebeat.yml:rw\"\n     - \"/var/run/docker.sock:/tmp/docker.sock:ro\"\n\n```\n\n### Filebeat\n```yml\nfilebeat:\n  prospectors:\n    - input_type: \"stdin\"\n      document_type: \"filebeat-docker-logs\"\n```\n### Logstash\n```conf\nfilter {\n\n  if [type] == \"filebeat-docker-logs\" {\n\n    grok {\n      match =\u003e { \n        \"message\" =\u003e \"\\[%{WORD:containerName}\\] %{GREEDYDATA:message_remainder}\"\n      }\n    }\n\n    mutate {\n      replace =\u003e { \"message\" =\u003e \"%{message_remainder}\" }\n    }\n\n    mutate {\n      remove_field =\u003e [ \"message_remainder\" ]\n    }\n\n  }\n\n}\n```\n\n### Testing\n```bash\ndocker run --label filebeat.stdin=true -d alpine /bin/sh -c 'while true; do echo \"Hello $(date)\"; sleep 1; done'\ndocker build -t filebeat\ndocker run -v /var/run/docker.sock:/tmp/docker.sock filebeat\n```\n\n## Contributors\n- @bargenson - main logic for the docker stdin\n- @gdubya - idea to use labels to choose what containers to log\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwillfarrell%2Fdocker-filebeat","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwillfarrell%2Fdocker-filebeat","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwillfarrell%2Fdocker-filebeat/lists"}