This post is older than a year. Consider some information might not be accurate anymore.
Used: metricbeat v6.2.4 docker v1.12.6
Metricbeat as docker container, is a decent monitoring solution to monitor other docker containers in conjunction with Elasticsearch and Kibana. Additionally metricbeat can monitor the docker system itself. You might run into some problems, which I would like to share.
If you have the docker module enabled and get this error message in the elasticsearch document.
Get http://unix.sock/containers/json?: dial unix /var/run/docker.sock: connect: no such file or directory
You need to mount /var/run/docker.sock as volume (read-only is sufficient) in the docker run option.
/var/run/docker.sock:/var/run/docker.sock:ro
Metricbeat has the user id 1000 in the container. To allow the container user to read from, set as superuser in the docker host system:
setfacl -m u:1000:rw /var/run/docker.sock
