This image contains journalbeat and a default configuration to forward to a Logstash host.
This is not done using a repeatable build. I gave up trying to get Journalbeat compile in Docker so I am adding the manually built (using
go build) binary manually.
Define LOGSTASH_HOST as a single host for the data to actually go anywhere.
Make sure your host machine is actually running journald, and mount
/etc/machine-id in their respective places.
:latest will be the same as
:logstash. But no promises.
Example run command:
docker run --name journalbeat --rm -v /var/log/journal:/var/log/journal -v /etc/machine-id:/etc/machine-id -e LOGSTASH_HOST=my.logstash.host:1234 sebjay/journalbeat:logstash
If you wish to save the journalbeat cursor (for e.g. restarting), mount
/jb-data to a persistent storage (I use
I tried to see if I could get 5.x running, but it doesn't seem to read any logs successfully. I think they've changed how logs are read - doing an strace reveals that it opens the logs and then immediately closes them again.
Sebjay - what was the issue getting a go program to compile in Docker? Btw - any chance to push an updated version of this that supports this recently merged PR? https://github.com/mheese/journalbeat/pull/34
This docker image works perfectly for our application, could you please share a link to the dockerfile.