# Aws ecs filebeat log collection stops when the application containers are restarted **URL:** \ **Category:** Beats\ **Tags:** docker, filebeat\ **Created:** [August 10, 2022, 12:52pm UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832 "2022-08-10T12:52:03Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![vaseem\_tt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaseem_tt/32/109488_2.png) [@vaseem\_tt](https://discuss.elastic.co/u/vaseem_tt)\ **Post date:** [August 10, 2022, 12:52pm UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832/1 "2022-08-10T12:52:03Z")
We collect the logs of the container of our java application on ecs with the container of Filebeat. When any one or multiple container in the AWS ECS intance restart continously, filebeat container stops pushing logs to elasticsearch. And if we restart the filebeat container then the logs starts coming. When I checked the Filebeat log, there were no errors. filebeat config file (filebeat.yml) ```auto setup.ilm.enabled: false filebeat.autodiscover: providers: - type: docker hints.enabled: true json.message_key: log templates: - condition: equals: docker.container.labels.filebeat_enable: "true" config: - type: docker containers.ids: - "${data.docker.container.id}" json.keys_under_root: true json.add_error_key: false multiline.pattern: '^\[\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.*' multiline.negate: true multiline.match: after multiline.timeout: 120s multiline.max_lines: 1000 processors: - add_cloud_metadata: ~ - add_docker_metadata: ~ output.elasticsearch: hosts: ["http://x.x.x.x:9200","http://x.x.x.x:9200","http://x.x.x.x:9200"] username: "XXX" password: "XXXX" ``` ---
**Author:** ![vaseem\_tt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaseem_tt/32/109488_2.png) [@vaseem\_tt](https://discuss.elastic.co/u/vaseem_tt)\ **Post date:** [August 15, 2022, 1:54pm UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832/2 "2022-08-15T13:54:34Z")
@system please help me out here ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [August 15, 2022, 9:36pm UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832/3 "2022-08-15T21:36:58Z")
@Tetiana_Kravchenko Could you take a look at this one please? TIA!! ---
**Author:** ![Tetiana\_Kravchenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tetiana_kravchenko/32/102683_2.png) [@Tetiana\_Kravchenko](https://discuss.elastic.co/u/Tetiana_Kravchenko)\ **Post date:** [August 16, 2022, 1:36pm UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832/4 "2022-08-16T13:36:27Z")
Hi @vaseem_tt I think that you need to use `container` as the `config.type`. Try to use [this configuration](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html#_co_elastic_logspipeline) (below the `co.elastic.logs/pipeline`) with `docker` as a autodiscover provider and `container` as a `template.config.type`. Also if you are not using hints based autodiscovery - `hints.enabled` can be removed from the configuration. ---
**Author:** ![vaseem\_tt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaseem_tt/32/109488_2.png) [@vaseem\_tt](https://discuss.elastic.co/u/vaseem_tt)\ **Post date:** [September 1, 2022, 10:59am UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832/5 "2022-09-01T10:59:25Z")
@Tetiana_Kravchenko we have updated the filebeat configuration as like you have mentioned above. But still the issue persists. ```auto setup.ilm.enabled: false filebeat.autodiscover: providers: - type: docker hints.enabled: true json.message_key: log templates: - condition: equals: docker.container.labels.filebeat_enable: "true" config: - type: container paths: - /var/lib/docker/containers/${data.docker.container.id}/*.log max_bytes: 1048576 json.keys_under_root: true json.add_error_key: false multiline.pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}' multiline.negate: true multiline.match: after multiline.timeout: 120s multiline.max_lines: 1000 close_inactive: 30s scan_frequency: 10s ``` ---
**Author:** ![vaseem\_tt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaseem_tt/32/109488_2.png) [@vaseem\_tt](https://discuss.elastic.co/u/vaseem_tt)\ **Post date:** [September 26, 2022, 3:10am UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832/6 "2022-09-26T03:10:35Z")
@system please can someone check this? ---
**Author:** ![vaseem\_tt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaseem_tt/32/109488_2.png) [@vaseem\_tt](https://discuss.elastic.co/u/vaseem_tt)\ **Post date:** [October 12, 2022, 5:07am UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832/7 "2022-10-12T05:07:45Z")
@system please look into this ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 9, 2022, 7:08am UTC](https://discuss.elastic.co/t/aws-ecs-filebeat-log-collection-stops-when-the-application-containers-are-restarted/311832/8 "2022-11-09T07:08:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.