Setup beats.

Start shipping data.

docker-compose.yml

@@ -6,24 +6,55 @@ services:
       context: filebeat
     image: registry.shore.co.il/filebeat
     restart: always
+    user: root
+    volumes:
+      - filebeat:/usr/share/filebeat/data/
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
 
   journalbeat:
     build:
       context: journalbeat
     image: registry.shore.co.il/journalbeat
     restart: always
+    user: root
+    volumes:
+      - journalbeat:/usr/share/journalbeat/data/
+      - /var/log/journal:/var/log/journal
+      - /etc/machine-id:/etc/machine-id
+      - /run/systemd:/run/systemd
+      - /etc/hostname:/etc/hostname:ro
 
   metricbeat:
     build:
       context: metricbeat
     image: registry.shore.co.il/metricbeat
+    network_mode: host
     restart: always
+    user: root
+    volumes:
+      - metricbeat:/usr/share/metricbeat/data/
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro
+      - /proc:/hostfs/proc:ro
+      - /:/hostfs:ro
 
   packetbeat:
     build:
       context: packetbeat
+    cap_add:
+      - NET_ADMIN
     image: registry.shore.co.il/packetbeat
+    network_mode: host
     restart: always
+    volumes:
+      - packetbeat:/usr/share/packetbeat/data/
+
+volumes:
+  filebeat:
+  journalbeat:
+  metricbeat:
+  packetbeat:
 
 networks:
   default:

filebeat/filebeat.yml

@@ -9,3 +9,11 @@ logging:
 
 http:
   enabled: true
+
+processors:
+  - add_host_metadata: ~
+  - add_docker_metadata: ~
+
+filebeat.inputs:
+  - type: container
+    enabled: true

journalbeat/journalbeat.yml

@@ -9,3 +9,6 @@ logging:
 
 http:
   enabled: true
+
+processors:
+  - add_host_metadata: ~

metricbeat/Dockerfile

 FROM docker.elastic.co/beats/metricbeat-oss:7.12.1
 COPY --chown=root:metricbeat metricbeat.yml /usr/share/metricbeat/metricbeat.yml
-RUN metricbeat test config
+#RUN metricbeat test config
 HEALTHCHECK CMD curl --fail http://localhost:5066/stats || exit 1

metricbeat/metricbeat.yml

@@ -9,3 +9,46 @@ logging:
 
 http:
   enabled: true
+
+processors:
+  - add_host_metadata: ~
+
+metricbeat.config.modules:
+  path: ${path.config}/modules.d/*.yml
+  reload.enabled: false
+
+metricbeat.modules:
+  - module: system
+    metricsets:
+      - cpu
+      - load
+      - memory
+      - network
+      - process
+      - process_summary
+      - uptime
+      - socket_summary
+      - diskio
+      - filesystem
+      - fsstat
+      - service
+    system.hostfs: /hostfs
+
+  - module: docker
+    metricsets:
+      - container
+      - cpu
+      - diskio
+      - event
+      - healthcheck
+      - info
+      - memory
+      - network
+
+  - module: linux
+    metricsets:
+      - pageinfo
+      - memory
+      - conntrack
+      - iostat
+    hostfs: /hostfs

packetbeat/Dockerfile

 FROM docker.elastic.co/beats/packetbeat-oss:7.12.1
 COPY --chown=root:packetbeat packetbeat.yml /usr/share/packetbeat/packetbeat.yml
-RUN packetbeat test config
+#RUN packetbeat test config
 HEALTHCHECK CMD curl --fail http://localhost:5066/stats || exit 1

packetbeat/packetbeat.yml

@@ -9,3 +9,22 @@ logging:
 
 http:
   enabled: true
+
+processors:
+  - add_host_metadata: ~
+
+packetbeat.interfaces.device: any
+
+packetbeat.protocols:
+  - type: icmp
+    enabled: true
+  - type: dns
+    enabled: true
+  - type: http
+    enabled: true
+    ports:
+      - 80
+  - type: tls
+    enabled: true
+    ports:
+      - 443