# AutoDiscover - can't ship docker container logs by image name **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 24, 2017, 7:58pm UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110 "2017-12-24T19:58:13Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Asaf\_Shabat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asaf_shabat/32/24442_2.png) [@Asaf\_Shabat](https://discuss.elastic.co/u/Asaf_Shabat)\ **Post date:** [December 24, 2017, 7:58pm UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/1 "2017-12-24T19:58:13Z")
I'm trying to set up the AutoDiscover component in the Filebeat.yml. I'm using it in order to take logs from specific containers which generated by a specific Docker image. When I'm working with the "filebeat.autodiscover" should I need to add the "filebeat.prospectors" block too? Currently, this is my configuration without filebeat.prospectors: ``` filebeat.autodiscover: # List of enabled autodiscover providers providers: - type: docker templates: - condition: equals.docker.container.image: wildfly_image config: - type: log paths: - /var/lib/docker/containers/${data.docker.container.id}/*.log processors: - add_docker_metadata: ~ fields: environment: WF-Prod fields_under_root: true multiline.pattern: '^[[:space:]]+|]$' multiline.match: after ``` As you can see, because of the "filebeat.prospectors" has been omitted, I had to add the processors, fields & multiline options under the "filebeat.autodiscover". Is it the right thing to do? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [December 26, 2017, 6:16pm UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/2 "2017-12-26T18:16:36Z")
Your setup looks good to me. I guess either a problem with your config (indentation?) or the docker container image is wrong. Can you share your whole `filebeat.yml` file and the debug log of filebeat run? ---
**Author:** ![Asaf\_Shabat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asaf_shabat/32/24442_2.png) [@Asaf\_Shabat](https://discuss.elastic.co/u/Asaf_Shabat)\ **Post date:** [December 27, 2017, 11:29am UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/3 "2017-12-27T11:29:16Z")
The issue was the indentation, and "add\_docker\_metadata" should be omitted. Working configuration is below: ``` filebeat.autodiscover: # List of enabled autodiscover providers providers: - type: docker templates: - condition: equals.docker.container.image: full_image_path/image_name:version config: - type: log paths: - /var/lib/docker/containers/${data.docker.container.id}/*.log fields: environment: Development fields_under_root: true multiline.pattern: '^[[:space:]]+|]$' multiline.match: after ``` Thanks a lot! ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [December 27, 2017, 1:07pm UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/4 "2017-12-27T13:07:08Z")
I'm glad you discovered the original issue @Asaf_Shabat, Also you may want to use the new `docker` prospector, available since 6.1, prospector conf would look like this: ```auto type: docker containers.ids: ${data.docker.container.id} multiline.pattern: '^[[:space:]]+|]$' multiline.match: after ``` ---
**Author:** ![Asaf\_Shabat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asaf_shabat/32/24442_2.png) [@Asaf\_Shabat](https://discuss.elastic.co/u/Asaf_Shabat)\ **Post date:** [December 27, 2017, 1:28pm UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/5 "2017-12-27T13:28:54Z")
Great, but how could I filter the containers by image name without the using of autodiscover? ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [December 27, 2017, 5:49pm UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/6 "2017-12-27T17:49:56Z")
Not at the moment, docker prospector is dumb, it only accepts container ids as it's what it uses to search for the logs. Autodiscover is in place to do what you want. Best regards ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [December 27, 2017, 5:58pm UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/7 "2017-12-27T17:58:49Z")
Also I forgot to mention, you are using `equals` condition, but you have [all existing conditions](https://www.elastic.co/guide/en/beats/filebeat/6.1/defining-processors.html#conditions) available, just in case you want to match only some part of the image, for instance. ---
**Author:** ![Asaf\_Shabat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asaf_shabat/32/24442_2.png) [@Asaf\_Shabat](https://discuss.elastic.co/u/Asaf_Shabat)\ **Post date:** [December 28, 2017, 6:37am UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/8 "2017-12-28T06:37:45Z")
Thank you very much! It helps! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 25, 2018, 6:38am UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110/9 "2018-01-25T06:38:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.