使用Docker将数据包发送到Elastic

Question

I tried this docker run command as suggested on official packetbeat installation page.

https://www.elastic.co/guide/en/beats/packetbeat/current/running-on-docker.html

I do not get any error, but container exits after loading index. It does not send any packets to the cloud server.

docker run \
--cap-add=NET_ADMIN \
docker.elastic.co/beats/packetbeat:7.0.0 \
setup -E setup.kibana.host=https://c3e635645b8441409a39f4456461e753.us-east-1.aws.found.io:9243 \
-E cloud.id=failed_query:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyQyZTZjNTg3YmZhODE0MTJiOGJiMzAzZWZjZDk3OGJlZiRjM2U2MzU2NDViODQ0MTQwOWEzOWY0NDU2NDYxZTc1Mw== \
-E cloud.auth=elastic:XXX

And the output is this...

Index setup complete.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

I will like to know how to use docker to send packets to elastic host.

Answer 1

That command is used to load the various modules required for Packetbeat onto Kibana, and make the ElasticSearch index, which it successfully did. In order to start forwarding packets, you have to configure Packetbeat using either volumes or by building a custom image as specified on the installation page.