===============================================
2020/4 / 1_ first edit ccb_warlock
===============================================
Since the last write filebeat mirrored building is already two years ago, and recently in the framework of the interceptors do write log into the ES level, then at the same time test ELK deployment of docker, I might re-build the most current (7.6.2) the filebeat.
Of course, I pull the official mirror looked under the mirror or so big, so I improved file directory or in the foundation before building contents, to bring it closer to the directory elk container.
The official also currently provides image library ( https://www.docker.elastic.co/ ), although the official description of the underlying image is centos, but the package out of the mirror is not only large capacity, and flexibility to build their own directory is not strong, so I suggest to build their own image.
As for individual finishing this construction method is to build and deploy I think the image of the container has always been two different things, before convenience record together, but seem long-winded (after all, some people just want to direct the official image deployment like, do not want to know mirroring is how constructed).
For ease of description, I was down to ambient centos7 describe the build process. If you just want to know how to deploy filebeat container, you can see the deployment entry (direct https://www.cnblogs.com/straycats/p/9153495.html ).
1. Get filebeat package
# Create a directory with the build
mkdir -p /opt/docker/build/filebeat
2. Create dockerfile,
cd /opt/docker/build/filebeat
we dockerfile
# Add the following to the file and save it in the dockerfile.
FROM ubuntu:18.04 WORKDIR /usr/share/filebeat COPY filebeat-7.6.1-linux-x86_64.tar.gz /usr/share RUN cd /usr/share && \ tar -xzf filebeat-7.6.1-linux-x86_64.tar.gz -C /usr/share/filebeat --strip-components=1 && \ rm -f filebeat-7.6.1-linux-x86_64.tar.gz && \ chmod +x /usr/share/filebeat ADD ./docker-entrypoint.sh /usr/bin/ RUN chmod +x /usr/bin/docker-entrypoint.sh ENTRYPOINT ["docker-entrypoint.sh"] CMD ["/usr/share/filebeat/filebeat","-e","-c","/usr/share/filebeat/filebeat.yml"]
PS.
1. Set the working directory and not the same as before, because the adjustment to the official directory of elk image according to a recent build elk.
2. ubuntu selected here because it is packaged as an underlying image is much smaller than centos. I have tried to use alpine: 3.7 as the underlying, but after the construction of Times Mirror operation "standard_init_linux.go: 190: exec user process caused" no such file or directory "", so finally chose ubuntu.
# Edit docker-entrypoint.sh
we docker-entrypoint.sh
# Add the following to the file and save it in the docker-entrypoint.sh.
#!/bin/bash set -e TMP=${PATHS} config=/usr/share/filebeat/filebeat.yml if [ ${TMP:0:1} = '/' ] ;then tmp='"'${PATHS}'"' be env echo 'Filebeat init process done. Ready for start up.' echo "Using the following configuration:" cat /usr/share/filebeat/filebeat.yml exec "$@"
3. Build Mirror
# Construct
cd /opt/docker/build/filebeat
docker build --rm -t filebeat:7.6.2 .
After the build is complete, docker images can be seen by more than a filebeat: 7.6.2 the mirror.
Then you can use it to create a container. ( Https://www.cnblogs.com/straycats/p/9153495.html )