# Can't to get a data from filebeats **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 3, 2018, 1:06pm UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079 "2018-09-03T13:06:03Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Hulio](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@Hulio](https://discuss.elastic.co/u/Hulio)\ **Post date:** [September 3, 2018, 1:06pm UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/1 "2018-09-03T13:06:03Z")
Hello, I'm trying setup elk + filebeats. It's my first time. If I right understand, It can show me filtered logs and any metrics. I install it in docker (with docker-compose) and now I have containers: elasticsearch, logstash, kibana, filebeat. All works but I cant see data in Kibana. docker logs [filebeat] ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/2/42c92f2a7650a7c94f9bc159b907629def56f3d0.png) How can I get a CPU load, memnory etc? ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [September 3, 2018, 1:27pm UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/2 "2018-09-03T13:27:59Z")
What metrics do you want to see? Do you have X-Pack monitoring enabled? ---
**Author:** ![Hulio](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@Hulio](https://discuss.elastic.co/u/Hulio)\ **Post date:** [September 4, 2018, 11:54am UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/3 "2018-09-04T11:54:43Z")
How can I do it? I was try add to Dockerfile of elasticsearch. FROM [docker.elastic.co/elasticsearch/elasticsearch-oss:6.4.0](http://docker.elastic.co/elasticsearch/elasticsearch-oss:6.4.0) ``` RUN bin/elasticsearch-plugin install x-pack ``` But I got Building elasticsearch Step 1/2 : FROM [docker.elastic.co/elasticsearch/elasticsearch-oss:6.4.0](http://docker.elastic.co/elasticsearch/elasticsearch-oss:6.4.0) ---\> a13ec2fa6275 Step 2/2 : RUN bin/elasticsearch-plugin install x-pack ---\> Running in c07ca5b8ecb3 ERROR: X-Pack is not available with the oss distribution; to use X-Pack features use the default distribution ---
**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\ **Post date:** [September 5, 2018, 1:35am UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/4 "2018-09-05T01:35:09Z")
To use the X-Pack enabled version of the Elasticsearch image, just remove `-oss` from the image name. Then you'll get the standard distribution that includes X-Pack. ---
**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\ **Post date:** [September 5, 2018, 1:39am UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/5 "2018-09-05T01:39:15Z")
Looking at your original question, I'm guessing that you would like to collect system metrics from your various hosts. Is that right? If so, you might want to add [Metricbeat](https://www.elastic.co/products/beats/metricbeat) to your setup. ---
**Author:** ![Hulio](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@Hulio](https://discuss.elastic.co/u/Hulio)\ **Post date:** [September 5, 2018, 3:28am UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/6 "2018-09-05T03:28:56Z")
I was start it, but have some troubles. after adding index metricbeat-\* I go to Discover and got error ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c23ae119fbb21215c6c2add987bbf60022fa6422.png) In dashboards I have list, but a lot of broken ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d90afe608bb35a1ae3274df6af3c1850b1cf9031.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1e152758f2f87bca7f41d1c762b9cfbfce60633.png) and other is empty ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d77079d945ad9ba7577768be8bbce833451d82df.png) Visualise is NoData too. ---
**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\ **Post date:** [September 7, 2018, 3:48am UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/7 "2018-09-07T03:48:01Z")
It looks like you are making progress. It's hard to help without seeing your Docker Compose file. Please share it if you'd like to. You can also try our comprehensive Compose example over [here](https://github.com/elastic/stack-docker). It might contain some ideas that help. ---
**Author:** ![Hulio](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@Hulio](https://discuss.elastic.co/u/Hulio)\ **Post date:** [September 7, 2018, 4:18am UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/8 "2018-09-07T04:18:02Z")
``` version: '2' services: elasticsearch: build: context: elasticsearch/ volumes: - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro ports: - "9200:9200" - "9300:9300" environment: ES_JAVA_OPTS: "-Xmx256m -Xms256m" networks: - elk logstash: build: context: logstash/ volumes: - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro - ./logstash/pipeline:/usr/share/logstash/pipeline:ro ports: - "5000:5000" environment: LS_JAVA_OPTS: "-Xmx256m -Xms256m" networks: - elk depends_on: - elasticsearch kibana: build: context: kibana/ volumes: - ./kibana/config/:/usr/share/kibana/config:ro ports: - "5601:5601" networks: - elk depends_on: - elasticsearch filebeat: hostname: filebeat # ** Here to build the image, you need to specify your own docker hub account : # image: bcoste/filebeat:latest build: context: ./filebeat volumes: # needed to persist filebeat tracking data : - "filebeat_data:/usr/share/filebeat/data:rw" # needed to access all docker logs (read only) : - "/var/lib/docker/containers:/usr/share/dockerlogs/data:ro" # needed to access additional informations about containers - "/var/run/docker.sock:/var/run/docker.sock" - "/var/log:/var/log" networks: - elk metricbeat: image: docker.elastic.co/beats/metricbeat:6.4.0 # https://github.com/docker/swarmkit/issues/1951 hostname: "metricbeat" user: root networks: - elk volumes: - ./metricbeat/metricbeat.yml:/usr/share/metricbeat/metricbeat.yml - /proc:/hostfs/proc:ro - /sys/fs/cgroup:/hostfs/sys/fs/cgroup:ro - /:/hostfs:ro - /var/run/docker.sock:/var/run/docker.sock - ./metricbeat:/usr/share/metricbeat/data environment: - ELASTICSEARCH_HOST=elasticsearch - KIBANA_HOST=kibana # disable strict permission checks command: ["--strict.perms=false", "-system.hostfs=/hostfs"] networks: elk: driver: bridge volumes: # create a persistent volume for Filebeat filebeat_data: ``` each Dockerfile looks like as `FROM docker.elastic.co/elasticsearch/elasticsearch:6.4.0` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 5, 2018, 6:18am UTC](https://discuss.elastic.co/t/cant-to-get-a-data-from-filebeats/147079/9 "2018-10-05T06:18:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.