Author: Alec

Recently, I had the need to run filebeat on a Raspberry Pi, in order to ship some logs to an elastic cluster.

Elastic does a fantastic job with all of their Beats. They work extremely well, are open source, and have fantastic support. They don’t release a binary built for ARM, though. So if you want to run Filebeat on your RPi, or other ARM-based machined, you’ll need to compile it yourself.

I’m not familiar with Go – which is what Filebeat is written in. I’m a big fan of all the Beats put out by Elastic, as well as other projects like bettercap and eviljinx. All written in Go. Personally, however, I’ve never written a single line.

With that in mind, I set out to compile filebeat from source. At first, I opted to set up my Go environment myself. After getting my environment ready, and attempting to compile filebeat, and getting several version mismatch errors, I rethought my approach.

As it happens, Google maintains Go development containers for every major version of Go. Using these containers make getting a Go environment extremely easy – I was thrilled to give this a ….go. Within a few minutes I had my freshly compiled binary transferred over to my RPi, and shortly thereafter I was shipping my data over to elastic and watching Kibana show all the new data. Fascinating stuff.

Getting this going is easy. The following exerpt is based off of the gist found here: https://gist.github.com/wjx0912/03779bf38dff53e72fae2ae2a2104ce1

# ----- Instantiate an immutable Go container for cross-compilation ----- #
mkdir build && cd $_
docker run -it --rm -v `pwd`:/build golang:latest /bin/bash

# ----- Inside Go container ----- #
go get github.com/elastic/beats
cd /go/src/github.com/elastic/beats/filebeat/
git checkout -b v7.6.0
GOARCH=arm go build
GOARCH=arm64 go build
cp filebeat /build
exit

# ----- Verify the output file ----- #
file filebeat
#filebeat: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, not stripped

And that’s it! Copy your newly compiled filebeat binary to your ARM machine and start shipping your data