Ubuntu下使用docker-compose运行Filebeat报错求助

在Ubuntu系统上通过docker-compose部署Elasticsearch、Kibana和Filebeat时，Elasticsearch和Kibana可正常启动，但Filebeat始终出现filebeat.yml相关错误，更换不同版本的Filebeat后问题依旧。

用户提供的docker-compose.yml

version: '3.8'

services:   
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.16.2
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      discovery.type: "single-node"
      ES_JAVA_OPTS: "-Xms2g -Xmx2g"
      xpack.monitoring.enabled: "true"
    volumes:
      - ./esdata:/usr/share/elasticsearch/data
      
  filebeat:
    image: docker.elastic.co/beats/filebeat:7.16.2
    build: filebeat
    entrypoint: "filebeat -e -strict.perms=false"
    container_name: filebeat
    restart: unless-stopped
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - ./logs:/usr/share/filebeat/logs:ro
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "2"
    depends_on:
      - elasticsearch
      
  kibana:
    image: docker.elastic.co/kibana/kibana:7.16.2
    restart: always
    ports:
      - "5601:5601"
    environment:
      ELASTICSEARCH_URL: http://elasticsearch:9200
    depends_on:
      - elasticsearch
      
volumes:
  esdata:
    driver: local

1. 校验配置文件语法与权限 #

• 先在本地用Filebeat官方镜像校验filebeat.yml的语法正确性：

  docker run --rm -v $(pwd)/filebeat.yml:/tmp/filebeat.yml docker.elastic.co/beats/filebeat:7.16.2 filebeat test config -c /tmp/filebeat.yml
  

• 调整宿主机上filebeat.yml的权限，确保容器内filebeat用户（UID 1000）能读取：

  chmod 644 ./filebeat.yml
  chown 1000:1000 ./filebeat.yml
  

2. 修正docker-compose中的Filebeat配置冲突 #

• 移除build: filebeat配置项：你同时指定了image和build，若没有自定义构建需求，该配置会导致镜像加载冲突；
• 明确配置文件路径：修改entrypoint，显式指定配置文件位置，避免路径识别问题：

  filebeat:
    image: docker.elastic.co/beats/filebeat:7.16.2
    entrypoint: ["filebeat", "-e", "-c", "/usr/share/filebeat/filebeat.yml", "-strict.perms=false"]
    container_name: filebeat
    restart: unless-stopped
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - ./logs:/usr/share/filebeat/logs:ro
      # 挂载data目录，避免容器重启后重复注册
      - ./filebeat-data:/usr/share/filebeat/data
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "2"
    depends_on:
      - elasticsearch
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
  

3. 确保filebeat.yml内容合规 #

YAML对缩进要求严格，必须用空格而非制表符，且需包含核心配置项示例：

filebeat.inputs:
- type: log
  paths:
    - /usr/share/filebeat/logs/*.log

output.elasticsearch:
  hosts: ["elasticsearch:9200"]

setup.kibana:
  host: "kibana:5601"

4. 查看完整错误日志定位问题 #

通过docker命令查看Filebeat容器的完整日志，获取更具体的错误提示：

docker logs filebeat

内容的提问来源于stack exchange，提问作者Gustavo Cruz