# Best practice to ship logs from docker containers
**URL:** https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615
**Category:** Beats
**Tags:** filebeat
**Created:** [April 26, 2018, 8:39am UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615 "2018-04-26T08:39:25Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [April 26, 2018, 8:39am UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615/1 "2018-04-26T08:39:25Z")
Hi there,
Shortly I changed some applications to docker containers. Also running some components of elastic stack in docker now (logstash, kibana).
So in general docker containers are logging to stdout, which I can see with `docker logs`.
But what is the best practice to ship container logs with filebeat?
I am using version 6.2.3 of elasitic stack including filebeat.
Thanks in advance, Andreas
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [April 26, 2018, 9:38am UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615/2 "2018-04-26T09:38:27Z")
Hi @asp,
Containers stdout/stderr is stored by Docker under `/var/lib/docker/containers`. We have a `docker`prospector that's able to read logs from there, parsing the Docker format. Also we provide with a processor that enriches logs with useful metadata from the source container, you can use a conf like this:
```auto
filebeat.prospectors:
# Read all docker containers:
- type: docker
containers.ids:
- '*'
# Enrich docker events with metadata:
processors:
- add_docker_metadata: ~
```
It will need to run with enough permissions to read `/var/lib/docker/containers/*` and talk to `/var/run/docker.sock` (for enriching).
You can run filebeat as a container too, just make sure you mount `/var/lib/docker/containers` and `/var/run/docker.sock`.
Best regards
---
### Author:  [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [April 26, 2018, 11:03am UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615/3 "2018-04-26T11:03:30Z")
@exekias thanks a lot. I will give it a try
---
### Author:  [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [April 26, 2018, 11:04am UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615/4 "2018-04-26T11:04:51Z")
is there a feature to filter for container names instead of ids?
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [April 26, 2018, 12:11pm UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615/5 "2018-04-26T12:11:03Z")
Yes,
You can use autodiscover for that:
[https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html)
Best regards
---
### Author:  [@ms4720](https://discuss.elastic.co/u/ms4720)
#### Post date: [April 27, 2018, 9:24am UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615/6 "2018-04-27T09:24:18Z")
Thanks you solved one of my questions, very kind of you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2018, 9:24am UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615/7 "2018-05-25T09:24:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.