How to overwrite ELASTICSEARCH_HOSTS and KIBANA_HOST in entrypoint.sh

[klausagnoletti]

Hi

I want to use remote elasticsearch and kibana for filebeats to send logs to. How do I overwrite the ELASTICSEARCH_HOSTS and KIBANA_HOST that are being set in the entrypoinst.sh when the container is started? Or would it be more ovious to use the vanilla filebeats docker from elastic instead? I also want to use your zeek docker, but I think that would work as-is.

Thanks

/klaus

[klausagnoletti]

Another option would be to fork the repo, change it and rebuild. But honestly that seems to be a lot of work just for a few hostnames that needs to be changed. I won't rule out that this is newbie questions. If so, I humbly apologize but would very much like a few pointers as to where I can find an answer.

Thanks for your great work :)

[klausagnoletti]

Allright, been doing a bit of investigation. I need to override the entrypoint. No problem, I do that with the --entrypoint argument to docker run. Where it gets tricky is how I override the two bash variables that defines elasticsearch and kibana hosts.
This doesn't work:
docker run --init -v pwd/docker_volumes/zeek_logs:/pcap --entrypoint="ELASTICSEARCH_HOSTS=10.20.30.160:9200 KIBANA_HOST=10.20.30.160:5601 /usr/local/bin/entrypoint" blacktop/filebeat:7.4.0
[FATAL tini (7)] exec ELASTICSEARCH_HOSTS=10.20.30.160:9200 KIBANA_HOST=10.20.30.160:5601 /usr/local/bin/entrypoint failed: No such file or directory

I am guessing that I am doing something basic bash-stuff wrong. And again, sorry for potentially asking stupid newbie questions. It's really hard to google an answer to this :)