Public | Automated Build

Last pushed: a month ago
Short Description
Filebeat Docker image
Full Description

Filebeat Docker image

This is a Docker image containing Filebeat. By default it will read your
logs and forward them to Logstash.

The recommended usage is to make a container from this image the data volume
for your logs.


You can pass command line parameters to Filebeat while launching this image, such as

docker run --rm -it expertsystems/filebeat --help

Logstash host

Unless you override the configuration file via image or parameters, when launching a container from this image you need
to supply the hostname and port where your Logstash is listening as the LOGSTASH_HOST environment variable.

docker run -d --name my-logs -e expertsystems/filebeat

The corresponding Logstash configuration would be

input {
  beats {
    port => 5044



To enable TLS/SSL with default configuration, set environment variable TLS to true.
To allow insecure
TLS/SSL, set TLS to true and INSECURE to true.

Data volume

Logs in /var/log and one level below (such as /var/log/myapplication/mylog.log) are forwarded. Furthermore /var/log
is declared as a volume, meaning you can use the --volumes-from parameter for the container whose logs you want to forward.

Continuing the example

docker run mycompany/myapp --volumes-from my-logs 


Tags correspond to the Filebeat version.

Docker Pull Command