Used: metricbeat v6.2.4 docker v1.12.6
Metricbeat as docker container, is a decent monitoring solution to monitor other docker containers in conjunction with Elasticsearch and Kibana. Additionally metricbeat can monitor the docker system itself. You might run into some problems, which I would like to share.
If you have the docker module enabled and get this error message in the elasticsearch document.
Get http://unix.sock/containers/json?: dial unix /var/run/docker.sock: connect: no such file or directory
You need to mount
/var/run/docker.sock as volume (read-only is sufficient) in the docker run option.
Metricbeat has the user id 1000 in the container. To allow the container user to read from, set as superuser in the docker host system:
setfacl -m u:1000:rw /var/run/docker.sock