# Capturing Elasticsearch Logs

**URL:** <https://discuss.elastic.co/t/capturing-elasticsearch-logs/161238>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [December 18, 2018, 4:48am UTC](https://discuss.elastic.co/t/capturing-elasticsearch-logs/161238 "2018-12-18T04:48:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mosiddi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mosiddi/32/577_2.png) [@mosiddi](https://discuss.elastic.co/u/mosiddi)\
**Post date:** [December 18, 2018, 4:48am UTC](https://discuss.elastic.co/t/capturing-elasticsearch-logs/161238/1 "2018-12-18T04:48:21Z")

</div>

Hi,  
In our Windows VMs, we capture Elasticsearch logs (using log4jappender) and write to Windows event viewer (using ETW logger). Then logs from event viewer can be streamed to our monitoring service. What do folks use for capturing Elasticsearch logs in case of Linux docker instances?  
Thanks  
Imran

---

<div class="post-metadata">

**Author:** ![Yunny.Lin](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@Yunny.Lin](https://discuss.elastic.co/u/Yunny.Lin)\
**Post date:** [December 18, 2018, 6:52am UTC](https://discuss.elastic.co/t/capturing-elasticsearch-logs/161238/2 "2018-12-18T06:52:06Z")

</div>

You can try to use IP mapping, map the VM's kibana out, and view it with win10 browser.  
😄

---

<div class="post-metadata">

**Author:** ![mosiddi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mosiddi/32/577_2.png) [@mosiddi](https://discuss.elastic.co/u/mosiddi)\
**Post date:** [December 18, 2018, 4:40pm UTC](https://discuss.elastic.co/t/capturing-elasticsearch-logs/161238/3 "2018-12-18T16:40:54Z")

</div>

Hi @Yunny.Lin, thanks for the suggestion. The only problem is these machines are PROD machines and the ports are not accessible outside! We enable a pipeline to capture logs from machine and put into monitoring service so the same can be analyzed later.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2019, 4:41pm UTC](https://discuss.elastic.co/t/capturing-elasticsearch-logs/161238/4 "2019-01-15T16:41:01Z")

</div>

Closed on January 15, 2019, 4:41pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.