Move filebeat to its own container

docker-compose.elk.yml.dist

@@ -8,6 +8,10 @@ services:
     container_name: ${CONTAINER_NAME}
     links:
     - elk
+    labels:
+    - "co.elastic.logs/enabled=true"
+    - "co.elastic.logs/module=system"
+    - "co.elastic.logs/fileset.stdout=syslog"
     ports:
     - "25:25"
     - "143:143"
@@ -24,6 +28,15 @@ services:
     - NET_ADMIN
     - SYS_PTRACE
     restart: always
+  filebeat:
+    image: docker.elastic.co/beats/filebeat:7.6.1
+    user: root
+    volumes:
+    - ./config/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro
+    - /var/run/docker.sock:/var/run/docker.sock:ro
+    - /var/lib/docker/containers/:/var/lib/docker/containers/:ro
+    command: ["filebeat", "-e", "--strict.perms=false"]
+    restart: always
   elk:
      build: elk
      ports: