Up-to-date filebeat for 32bit Raspbian (armhf)

Fiddling around with ELK recently, I’ve been setting up a log server. Deploying filebeat to my Raspbian (RPi 2, 3, 4, nano) systems turned out somewhat challenging, mostly since elastic doesn’t provide official releases for 32bit ARM. There’s been an open ticket since 2018 asking for official ARM builds, and it seems that elastic is now at least providing .deb packages for 64bit ARM.

This got me thinking, what if I just compile a filebeat armhf binary and repackage the given arm64 .deb file? Turns out, it’s quite easy. Here’s my all-in-one script, tested on x64 Debian 10 and Ubuntu 20.10:


The interesting stuff happens in the four last functions. Here’s a rundown:

  • working directory is ~/Downloads/filebeat_armhf
  • get latest golang amd64 package for cross-compiling, extract to working dir, specifically use it’s given go binary (ignore any global installations)
  • get latest filebeat arm64 .deb package
  • clone beats repo, checkout latest release branch
  • build arm (armhf) filebeat binary with new go release
  • repackage given arm64 .deb with new filebeat binary, removing other binary (filebeat-god, seems to be irrelevant), update md5sums file, crontrol file
  • working dir cleanup

Result of this poor man’s CI (at the time of writing) is a new deb file, ready to be deployed on Raspbian: ~/Downloads/filebeat_armhf/filebeat-7.11.2-armhf.deb

I have some further automation in place, deploying the new deb to a publicly available web server. A small puppet module is taking it from there:

if $facts['os']['distro']['id'] == 'Raspbian' {
# 'archive' requires puppet-archive module
  archive { '/root/filebeat-7.11.2-armhf.deb':
    ensure => 'present',
    source => 'https://example.com/filebeat-7.11.2-armhf.deb';
  package { 'beat':
    provider => 'dpkg',
    ensure   => 'installed',
    source   => "/root/filebeat-7.11.2-armhf.deb",
    require  => Archive['/root/filebeat-7.11.2-armhf.deb'];
# fileconfig config with pcfens-filebeat module here

2 thoughts on “Up-to-date filebeat for 32bit Raspbian (armhf)

  1. Bonjour,
    je n’arrive pas à obtenir de résultat sur ma machine Debian 10.9.

    “root@gameserver:/home/game# ./armscript.sh

    ### Working dir: /root/Downloads/filebeat_armhf

    ### Cleaning up files

    ### Cleaning up files”

    En le lançant en mode verbose, je ne vois pas d’erreur non plus.
    Se pourrait il qu’il soit devenu incompatible suite à des mises à jour ?

    1. Hello,

      I don’t speak french, but the issue has been fixed. Due to -o pipefail and the fact that head -n 1 gives a non-zero exit code at the end of the pipe, the script stops in the setup_local_go() function. I’ve replaced head with an awk expression in the github gist.

      By the way, please avoid running it as root.


Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to top