92 lines
3 KiB
Text
92 lines
3 KiB
Text
|
[[running-on-docker]]
|
||
|
|
=== Running {beatname_uc} on Docker
|
||
|
|
|
||
|
|
Docker images for {beatname_uc} are available from the Elastic Docker
|
||
|
|
registry. The base image is https://hub.docker.com/_/centos/[centos:7].
|
||
|
|
|
||
|
|
A list of all published Docker images and tags is available at
|
||
|
|
https://www.docker.elastic.co[www.docker.elastic.co]. The source code is in
|
||
|
|
{dockergithub}[GitHub].
|
||
|
|
|
||
|
|
These images are free to use under the Elastic license. They contain open source
|
||
|
|
and free commercial features and access to paid commercial features.
|
||
|
|
{xpack-ref}/license-management.html[Start a 30-day trial] to try out all of the
|
||
|
|
paid commercial features. See the
|
||
|
|
https://www.elastic.co/subscriptions[Subscriptions] page for information about
|
||
|
|
Elastic license levels.
|
||
|
|
|
||
|
|
==== Pulling the image
|
||
|
|
|
||
|
|
Obtaining Beats for Docker is as simple as issuing a +docker pull+ command
|
||
|
|
against the Elastic Docker registry.
|
||
|
|
|
||
|
|
ifeval::["{release-state}"=="unreleased"]
|
||
|
|
|
||
|
|
However, version {stack-version} of {beatname_uc} has not yet been
|
||
|
|
released, so no Docker image is currently available for this version.
|
||
|
|
|
||
|
|
endif::[]
|
||
|
|
|
||
|
|
ifeval::["{release-state}"!="unreleased"]
|
||
|
|
|
||
|
|
["source", "sh", subs="attributes"]
|
||
|
|
------------------------------------------------
|
||
|
|
docker pull {dockerimage}
|
||
|
|
------------------------------------------------
|
||
|
|
|
||
|
|
Alternatively, you can download other Docker images that contain only features
|
||
|
|
available under the Apache 2.0 license. To download the images, go to
|
||
|
|
https://www.docker.elastic.co[www.docker.elastic.co].
|
||
|
|
|
||
|
|
endif::[]
|
||
|
|
|
||
|
|
[float]
|
||
|
|
==== Configure {beatname_uc} on Docker
|
||
|
|
|
||
|
|
The Docker image provides several methods for configuring {beatname_uc}. The
|
||
|
|
conventional approach is to provide a configuration file via a bind mount, but
|
||
|
|
it's also possible to create a custom image with your
|
||
|
|
configuration included.
|
||
|
|
|
||
|
|
[float]
|
||
|
|
===== Bind-mounted configuration
|
||
|
|
|
||
|
|
One way to configure {beatname_uc} on Docker is to provide +{beatname_lc}.yml+ via a bind mount.
|
||
|
|
With +docker run+, the bind mount can be specified like this:
|
||
|
|
|
||
|
|
["source", "sh", subs="attributes"]
|
||
|
|
--------------------------------------------
|
||
|
|
docker run \
|
||
|
|
--mount type=bind,source="$(pwd)"/{beatname_lc}.yml,target=/usr/share/{beatname_lc}/{beatname_lc}.yml \
|
||
|
|
{dockerimage}
|
||
|
|
--------------------------------------------
|
||
|
|
|
||
|
|
[float]
|
||
|
|
===== Custom image configuration
|
||
|
|
|
||
|
|
It's possible to embed your {beatname_uc} configuration in a custom image.
|
||
|
|
Here is an example Dockerfile to achieve this:
|
||
|
|
|
||
|
|
ifeval::["{beatname_lc}"!="auditbeat"]
|
||
|
|
|
||
|
|
["source", "dockerfile", subs="attributes"]
|
||
|
|
--------------------------------------------
|
||
|
|
FROM {dockerimage}
|
||
|
|
COPY {beatname_lc}.yml /usr/share/{beatname_lc}/{beatname_lc}.yml
|
||
|
|
USER root
|
||
|
|
RUN chown root:{beatname_lc} /usr/share/{beatname_lc}/{beatname_lc}.yml
|
||
|
|
USER {beatname_lc}
|
||
|
|
--------------------------------------------
|
||
|
|
|
||
|
|
endif::[]
|
||
|
|
|
||
|
|
ifeval::["{beatname_lc}"=="auditbeat"]
|
||
|
|
|
||
|
|
["source", "dockerfile", subs="attributes"]
|
||
|
|
--------------------------------------------
|
||
|
|
FROM {dockerimage}
|
||
|
|
COPY {beatname_lc}.yml /usr/share/{beatname_lc}/{beatname_lc}.yml
|
||
|
|
--------------------------------------------
|
||
|
|
|
||
|
|
endif::[]
|