Can filebeats to read lxc container logs?

from the host, I can read the lxc contianers logs using root like
but when I put the above path into filebeats as one path for log type of inputs , it can not find it.( A harvester on the above path is not created). I also tried to use the container input type, also it does not work.

How can I debug why filebeats can not read it even the folder is readable from the host using root?

Hi! Are the double-slashes in your path intentional? It looks like you want /var/lib/lxc/test/logs/*.log but instead have /var/lib/lxc//test//logs/*.log. Perhaps that's just a typo, though -- if that doesn't fix it, could you share your filebeat.yml? What you want should be possible but more information will help troubleshoot where it's going wrong.

ah. it is a typo. and here is the whole filebeat.yml with redacting some credentials


  • type: log
    • /var/log/*.log
    • /var/lib/lxc//test//logs/*.log


  • add_cloud_metadata: ~

hosts: ["http://xxxx:9200"]
username: beats_system
password: xxx
monitoring.enabled: true
username: beats_system
password: xxxxx

are the logs below /var/log/.log can be shipped vi filebeats and I can see one harvester created for each log, bit for /var/lib/lxc//test//logs/.log, I can not see any harvester created for the files here.
Also I can not see any errors on this.
As I mentioned above, I can access those files using root, and also filebeat are launched using root.

Let me know what info I could provide for your further insights on this.


@faec any insights on this? Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.