Cross-compile Elastic Filebeat for ARM with docker. Works on Raspberry Pi 2 and 3.

cross-compile_filebeat_arm.md

Elastic does not provide Filebeat binaries for ARMv7. Luckily, Filebeat can easily be cross-compiled with:

# ----- Instantiate an immutable Go container for cross-compilation ----- #
mkdir build && cd $_
docker run -it --rm -v `pwd`:/build golang:1.11.4 /bin/bash

# ----- Inside Go container ----- #
go get github.com/elastic/beats
cd /go/src/github.com/elastic/beats/filebeat/
git checkout -b v6.5.4
GOARCH=arm go build
GOARCH=arm64 go build
cp filebeat /build
exit

# ----- Verify the output file ----- #
file filebeat
#filebeat: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, not stripped

The newly built Filebeat binary can then be uploaded to the remote PCM3, for example with http://transfer.sh

On the PCM3:

• Download the official 32-bit Linux archive from https://www.elastic.co/downloads/beats/filebeat. Extract the archive and replace the Filebeat binary with the one you cross-compiled and uploaded.
• Install Filebeat by following the Mac instructions at https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html
• Configure Filebeat as described in the Using Filebeat section at https://logz.io/blog/docker-logging/
• Run Filebeat and confirm your logs show up in Kibana at elk_stack_ip:5601 with a filebeat-* index pattern.

Looks like its an issue where golang in apt repos is currently v1.11.6, where strings.ReplaceAll became available in go v1.12 (per codewars/codewars.com#1861). Following this gist, I was able to get things working: https://gist.github.com/bigsan/c936451ed1a5b18bb8b0d7e8cc3e7212

I have extended the file with the systemd configuration to start as service https://gist.github.com/joariasl/153a1d5253dc938429e2e5936339959a