# Applying docker input to Nginx module with autodiscover

**URL:** <https://discuss.elastic.co/t/applying-docker-input-to-nginx-module-with-autodiscover/152032>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 11, 2018, 11:04am UTC](https://discuss.elastic.co/t/applying-docker-input-to-nginx-module-with-autodiscover/152032 "2018-10-11T11:04:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Claude\_Juif](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@Claude\_Juif](https://discuss.elastic.co/u/Claude_Juif)\
**Post date:** [October 11, 2018, 11:04am UTC](https://discuss.elastic.co/t/applying-docker-input-to-nginx-module-with-autodiscover/152032/1 "2018-10-11T11:04:14Z")

</div>

Hi people,

I'm currently struggling to apply docker input to the Nginx module with filebeat 6.4.1.

Here is my filebeat configuration file :

```
filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - condition.contains:
             docker.container.image: nginx
          config:
            - module: nginx
              access:
                enabled: true
                input:
                  - type: docker
                    combine_partial: false
                    fields_under_root: true
                    containers:
                      stream: "stdout"
                      paths:
                        - "/var/lib/docker/containers"
                      ids:
                        - "${data.docker.container.id}"
                    processors:
                      - add_cloud_metadata: ~
                      - add_docker_metadata: ~
                      - decode_json_fields:
                        fields: ['message']
                        target: "json"

```

If I try to only set the docker inputs, it works but without nginx data, if i try to set only the nginx module, it works, but with a grok parser failure because the nginx log message is a json and not a string.

If I try to mix both of them, nothing happen, no docker logs are sent to ES at all.

It seems I am pretty close to it, but can't figure what's wrong.

I run filebeat with filebeat -e -d '\*' but can't see errors.

Here is the attached logs :  
[Filebeat debug log](https://gist.github.com/cjuif/c2736d451ace3b0858d82e7c78f289b6)

Can you please point me in the right direction ?

Best regards,

---

<div class="post-metadata">

**Author:** ![Claude\_Juif](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@Claude\_Juif](https://discuss.elastic.co/u/Claude_Juif)\
**Post date:** [October 12, 2018, 10:01am UTC](https://discuss.elastic.co/t/applying-docker-input-to-nginx-module-with-autodiscover/152032/2 "2018-10-12T10:01:46Z")

</div>

Hi,

Sorry for disturbing, but I managed to get it work with this config file.

I left it here in case it can help someone else :

```
filebeat.autodiscover:
  providers:
    - type: docker
      processors:
      - add_cloud_metadata: ~
      templates:
        - condition:
            contains.docker.container.image: "nginx"
          config:
            - module: nginx
              access:
                input:
                  type: docker
                  processors:
                  - add_cloud_metadata: ~
                  containers.ids: "${data.docker.container.id}"
                  containers.stream: stdout
              error:
                input:
                  type: docker
                  processors:
                  - add_cloud_metadata: ~
                  containers.ids: "${data.docker.container.id}"
                  containers.stream: stderr

```

Best Regards,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2018, 10:09am UTC](https://discuss.elastic.co/t/applying-docker-input-to-nginx-module-with-autodiscover/152032/3 "2018-11-09T10:09:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.