diff --git a/README.md b/README.md index 43d6104..181639e 100644 --- a/README.md +++ b/README.md @@ -8,6 +8,7 @@ Documentation can be found on the [Elastic website][elastic]: * [auditbeat][auditbeat] * [filebeat][filebeat] * [heartbeat][heartbeat] +* [journalbeat][journalbeat] * [metricbeat][metricbeat] * [packetbeat][packetbeat] @@ -16,6 +17,7 @@ Documentation can be found on the [Elastic website][elastic]: [auditbeat]: https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html [filebeat]: https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html [heartbeat]: https://www.elastic.co/guide/en/beats/heartbeat/current/running-on-docker.html +[journalbeat]: https://www.elastic.co/guide/en/beats/journalbeat/current/running-on-docker.html [metricbeat]: https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-docker.html [packetbeat]: https://www.elastic.co/guide/en/beats/packetbeat/current/running-on-docker.html diff --git a/beats.txt b/beats.txt index 89238e0..dd754b6 100644 --- a/beats.txt +++ b/beats.txt @@ -1,5 +1,6 @@ auditbeat filebeat heartbeat +journalbeat metricbeat packetbeat diff --git a/build/journalbeat/config/journalbeat.yml b/build/journalbeat/config/journalbeat.yml new file mode 100644 index 0000000..5e1b534 --- /dev/null +++ b/build/journalbeat/config/journalbeat.yml @@ -0,0 +1,11 @@ +journalbeat.inputs: +- paths: [] + +processors: +- add_host_metadata: +- add_cloud_metadata: + +output.elasticsearch: + hosts: ['elasticsearch:9200'] + username: elastic + password: changeme diff --git a/templates/docker-compose.yml.j2 b/templates/docker-compose.yml.j2 index 4f03f89..1a11f6d 100644 --- a/templates/docker-compose.yml.j2 +++ b/templates/docker-compose.yml.j2 @@ -24,4 +24,10 @@ services: - NET_RAW - NET_ADMIN {%- endif %} + + {% if beat == 'journalbeat' %} + volumes: + - /etc/machine-id:/etc/machine-id + - /etc/hostname:/etc/hostname:ro + {%- endif %} {% endfor %}