packetbeat-docker-compose.yml

version: "3.8"

services:

  packetbeat:
    image: docker.elastic.co/beats/packetbeat:${ELASTIC_VERSION:-7.9.1}
    # https://github.com/docker/swarmkit/issues/1951
    hostname: "{{.Node.Hostname}}-packetbeat"
    user: root
    networks:
      - elastic
    configs:
      - source: pb_config
        target: /usr/share/packetbeat/packetbeat.yml
    volumes:
      - packetbeat:/usr/share/packetbeat/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - ELASTICSEARCH_HOST=${ELASTICSEARCH_HOST:-node1}
      - KIBANA_HOST=${KIBANA_HOST:-node1}
      - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME:-elastic}
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
      # Eagerly waiting for Docker 19.06 release which will bring --privileged flag to Docker
      # Swarm Mode https://github.com/moby/moby/issues/24862#issuecomment-451594187
      # support for capabilities https://github.com/moby/moby/pull/38380
    cap_add:
      - NET_RAW
      - NET_ADMIN
    command: ["--strict.perms=false"]
    deploy:
      mode: global

networks:
  elastic:
    external: true
    name: host

volumes:
  packetbeat:

configs:
  pb_config:
    file: $PWD/elk/beats/packetbeat/config/packetbeat.yml