services:
  metricbeat:
    build:
      context: extensions/metricbeat/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    # Run as 'root' instead of 'metricbeat' (uid 1000) to allow reading
    # 'docker.sock' and the host's filesystem.
    user: root
    # If AppArmor or SELinux are enabled on the host, some permissions may be
    # denied unless the container is running with escalated privileges.
    # Use with extreme care.
    #privileged: true
    cap_add:
      # Allows collecting I/O metrics for host processes.
      - SYS_PTRACE
    command:
      # Log to stderr.
      - -e
      # Disable config file permissions checks. Allows mounting
      # 'config/metricbeat.yml' even if it's not owned by root.
      # see: https://www.elastic.co/docs/reference/beats/libbeat/config-file-permissions
      - --strict.perms=false
      # Mount point of the host’s filesystem. Required to monitor the host
      # from within a container.
      - --system.hostfs=/hostfs
    volumes:
      - ./extensions/metricbeat/config/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml:ro,Z
      - type: bind
        source: /
        target: /hostfs
        read_only: true
      - type: bind
        source: /sys/fs/cgroup
        target: /hostfs/sys/fs/cgroup
        read_only: true
      - type: bind
        source: /proc
        target: /hostfs/proc
        read_only: true
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: true
    environment:
      METRICBEAT_INTERNAL_PASSWORD: ${METRICBEAT_INTERNAL_PASSWORD:-}
      MONITORING_INTERNAL_PASSWORD: ${MONITORING_INTERNAL_PASSWORD:-}
      BEATS_SYSTEM_PASSWORD: ${BEATS_SYSTEM_PASSWORD:-}
    cgroup: host
    networks:
      - elk
    depends_on:
      - elasticsearch