8.17.0 docker containers not starting with default arguments

[wargamez]

docker run docker.elastic.co/beats/metricbeat:8.17.0
Error: unknown command "container" for "metricbeat"
Run 'metricbeat --help' for usage.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[belimawr]

I can confirm and reproduce it.

[Edit]
The most correct workaround is to pass --environment container to the docker image:

tiago@millennium-falcon ~ % docker run -d --name filebeat docker.elastic.co/beats/filebeat:8.17.0 --environment container 
8747f07c833089db7f5a0a5356ca0700bc9021fc20b659d695e2d8d8cadd8eaf
tiago@millennium-falcon ~ % docker logs -f filebeat 

This effectively fixes the bug (using -envrionment. One dash - instead of two --).

[Previous workaround]
I found an easy workaround, you can add -e as an argument and it will run and send the logs to stderr:

 docker run -d --name metribeat docker.elastic.co/beats/metricbeat:8.17.0 -e
 docker logs -f metribeat

[fonfalleh]

Probably the same cause and workaround possible as in #42039

[cmacknz]

Yes, the Beats are mostly all built from the same Dockerfile template.

I closed #42039 as a duplicate and generalized the title of this issue so we don't end up with an issue for each unique Beat.

Thanks for reporting this. We have many automated tests for our Docker containers, but as it turns out none that start them without adding additional arguments.

The reference Kubernetes YAML includes the workaround by default.

beats/deploy/kubernetes/filebeat-kubernetes.yaml

Lines 184 to 190 in e07b5c9

	containers:
	- name: filebeat
	image: docker.elastic.co/beats/filebeat-wolfi:9.0.0
	args: [
	"-c", "/etc/filebeat.yml",
	"-e",
	]

[wargamez]

but adding a -e would redirect all logs to stderr and not stdout according to the documentation of -e, so really it is not a fix? A fix would be to change and fix the Dockerfile CMD commend to use --environment instead of -environment. filebeat --help says it should be with --environmen, but in the official Dockerfile and online doc -environment is used. Or fix the startup script to be able to handle -environment

Ref: https://hub.docker.com/layers/elastic/metricbeat/8.17.0/images/sha256-7ba3768050419565c3dc82ad5fa641fa7de1e5709dafbcd8aaf2c3399d589a24

docker run docker.elastic.co/beats/filebeat:8.17.0 --help
Usage:
filebeat [flags]
filebeat [command]

Available Commands:
export Export current config or index template
generate Generate Filebeat modules, filesets and fields.yml
help Help about any command
keystore Manage secrets keystore
modules Manage configured modules
run Run filebeat
setup Setup index template, dashboards and ML jobs
test Test config
version Show current version info

Flags:
-E, --E setting=value Configuration overwrite
-M, --M setting=value Module configuration overwrite
-N, --N Disable actual publishing for testing
-c, --c string Configuration file, relative to path.config (default "filebeat.yml")
--cpuprofile string Write cpu profile to file
-d, --d string Enable certain debug selectors
-e, --e Log to stderr and disable syslog/file output
--environment environmentVar set environment being ran in (default default)
-h, --help help for filebeat
--httpprof string Start pprof http server
--memprofile string Write memory profile to this file
--modules string List of enabled modules (comma separated)
--once Run filebeat only once until all harvesters reach EOF
--path.config string Configuration path
--path.data string Data path
--path.home string Home path
--path.logs string Logs path
--plugin pluginList Load additional plugins
--strict.perms Strict permission checking on config files (default true)
-v, --v Log at INFO level

Use "filebeat [command] --help" for more information about a command.

[fonfalleh]

Agreed. Using two dashes works, and differs from docs. Potentially related commit mentioned in #42039 (comment)

…

On Mon, 16 Dec 2024, 17:31 wargamez, ***@***.***> wrote: but adding a -e would redirect all logs to stderr and not stdout according to the documentation of -e, so really it is not a fix? A fix would be to change and fix the Dockerfile CMD commend to use --environment instead of -environment. filebeat --help says it should be with --environmen, but in the official Dockerfile and online doc -environment is used. Or fix the startup script to be able to handle -environment Ref: https://hub.docker.com/layers/elastic/metricbeat/8.17.0/images/sha256-7ba3768050419565c3dc82ad5fa641fa7de1e5709dafbcd8aaf2c3399d589a24 docker run docker.elastic.co/beats/filebeat:8.17.0 --help Usage: filebeat [flags] filebeat [command] Available Commands: export Export current config or index template generate Generate Filebeat modules, filesets and fields.yml help Help about any command keystore Manage secrets keystore modules Manage configured modules run Run filebeat setup Setup index template, dashboards and ML jobs test Test config version Show current version info Flags: -E, --E setting=value Configuration overwrite -M, --M setting=value Module configuration overwrite -N, --N Disable actual publishing for testing -c, --c string Configuration file, relative to path.config (default "filebeat.yml") --cpuprofile string Write cpu profile to file -d, --d string Enable certain debug selectors -e, --e Log to stderr and disable syslog/file output --environment environmentVar set environment being ran in (default default) -h, --help help for filebeat --httpprof string Start pprof http server --memprofile string Write memory profile to this file --modules string List of enabled modules (comma separated) --once Run filebeat only once until all harvesters reach EOF --path.config string Configuration path --path.data string Data path --path.home string Home path --path.logs string Logs path --plugin pluginList Load additional plugins --strict.perms Strict permission checking on config files (default true) -v, --v Log at INFO level Use "filebeat [command] --help" for more information about a command. — Reply to this email directly, view it on GitHub <#42038 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA3NRE36RYVW6SFOPZJVG4T2F357NAVCNFSM6AAAAABTS5T6VOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNBWGA4TEMJYG4> . You are receiving this because you commented.Message ID: ***@***.***>

[cmacknz]

A fix would be to change and fix the Dockerfile CMD commend to use --environment instead of -environment.

Yes there is a draft PR for this in the works already #42060.

K8s has always used -e and I am over focusing on that because it is the most common use of the container, but you are right that -e is not the same as --environment and the known issue and even the docs for 8.17.0 for getting started can be updated to explicitly specifying --environment instead of -e as the work around.