Filebeat compatibility
Use docker.elastic.co/beats/filebeat:8.17.3 on amd64 or arm64. The ingest host provides a static version handshake and basic license response; bulk writes require your ingest key. Keep templates and lifecycle management disabled. Set EPOK_INGEST_KEY in the process environment; headers.X-API-Key sends it without the different Elasticsearch ApiKey encoding. Real-agent acceptance awaits the deployment and rig run.
Configuration
filebeat.inputs:
- type: log
enabled: true
paths: [/var/log/filebeat.log]
scan_frequency: 1s
fields_under_root: true
fields:
service: p2-filebeat
setup.ilm.enabled: false
setup.template.enabled: false
monitoring.enabled: false
output.elasticsearch:
hosts: ["https://ingest.getepok.dev"]
index: p2-filebeat
headers:
X-API-Key: ${EPOK_INGEST_KEY}
compression_level: 0
bulk_max_size: 1
backoff.init: 1s
backoff.max: 5s
queue.mem:
flush.min_events: 1
flush.timeout: 1s
Keep your ingest key private. Missing keys return 401; unknown keys return 403. A successful HTTP response alone is not proof of stored data.
Real-agent acceptance
The acceptance rig requires the exact unique file line and service p2-filebeat to reach the key’s workspace and project. The endpoint returns one acknowledgement for each bulk action. This same check covers the Elasticsearch bulk compatibility row.
From a source checkout with Docker Compose, run the isolated acceptance rig. It uses a fresh key and run marker, publishes no host ports, and removes its stack on exit. Every required stored-data check must pass.
scripts/p2_agent_acceptance.sh