How start filebeat inside docker container?

Question

I try to start filebeat inside dockercontainer.

At the begining I try to start by this Dockerfile

FROM tomcat:8.5
RUN rm -Rf /usr/local/tomcat/webapps/ROOT/*
RUN mkdir /usr/local/tomcat/webapps-my

COPY filebeat/ /opt/filebeat/
RUN chmod +x /opt/filebeat/filebeat

COPY db-creator.jar /opt/db-creator/

COPY ./docker-entrypoint.sh /
RUN chmod +x /docker-entrypoint.sh
ENTRYPOINT ["/docker-entrypoint.sh"]
ENTRYPOINT ["/opt/filebeat/filebeat", "-e", "-c", "/opt/filebeat/filebeat.yml"]
COPY server.xml /usr/local/tomcat/conf
COPY my.war /usr/local/tomcat/webapps-my/ROOT.war

CMD ["catalina.sh", "run"]

In this case filebeat is starting but it works in console and tomcat doesn't starts. Now I try start filebeat as service

FROM tomcat:8.5
RUN curl -L -O https://artifacts.elastic.co/downloads/beats/fileb...
RUN dpkg -i filebeat-5.2.2-amd64.deb
COPY filebeat.yml /etc/filebeat
RUN update-rc.d filebeat defaults 95 10

COPY db-creator.jar /opt/db-creator/
COPY ./docker-entrypoint.sh /
RUN chmod +x /docker-entrypoint.sh
ENTRYPOINT ["/docker-entrypoint.sh"]

RUN rm -Rf /usr/local/tomcat/webapps/ROOT/*
COPY server.xml /usr/local/tomcat/conf
RUN mkdir /usr/local/tomcat/webapps-my
COPY my.war /usr/local/tomcat/webapps-iqp/ROOT.war

CMD ["catalina.sh", "run"]

But it stil doesn't start at all. Betweeen these varint's I have some other varints but they doesn't work too. For example something like this

CMD ["/etc/init.d/filebeat", "start"]

How can I start filebeat?

Answer 1

Your approach is kinda wrong. Think about microservices architecture. You need one microservice per container.

Try the following:

You need 2 separate containers here. One for tomcat and another for filebeat . Then you will mount a volume on appropriate location in tomcat container so you get the log files there.

Then you will mount the same log volume on filebeat as readonly at the same time and start shipping the logs using filebeat.

This way you will honor microservices architecture and docker philosophy.

Update : If you configure tomcat to log to stdout and stderr, You will be able to use various log drivers that are available and the list at the time of update is the following.

Driver  Description
none    No logs are available for the container and docker logs does not return any output.
json-file   The logs are formatted as JSON. The default logging driver for Docker.
local   Writes logs messages to local filesystem in binary files using Protobuf.
syslog  Writes logging messages to the syslog facility. The syslog daemon must be running on the host machine.
journald    Writes log messages to journald. The journald daemon must be running on the host machine.
gelf    Writes log messages to a Graylog Extended Log Format (GELF) endpoint such as Graylog or Logstash.
fluentd     Writes log messages to fluentd (forward input). The fluentd daemon must be running on the host machine.
awslogs     Writes log messages to Amazon CloudWatch Logs.
splunk  Writes log messages to splunk using the HTTP Event Collector.
etwlogs     Writes log messages as Event Tracing for Windows (ETW) events. Only available on Windows platforms.
gcplogs     Writes log messages to Google Cloud Platform (GCP) Logging.
logentries  Writes log messages to Rapid7 Logentries.