# Check Docker Filebeat in VM is sending to Docker logstash in another VM

**URL:** <https://discuss.elastic.co/t/check-docker-filebeat-in-vm-is-sending-to-docker-logstash-in-another-vm/197411>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [August 29, 2019, 7:36pm UTC](https://discuss.elastic.co/t/check-docker-filebeat-in-vm-is-sending-to-docker-logstash-in-another-vm/197411 "2019-08-29T19:36:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeffery](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jeffery](https://discuss.elastic.co/u/jeffery)\
**Post date:** [August 29, 2019, 7:36pm UTC](https://discuss.elastic.co/t/check-docker-filebeat-in-vm-is-sending-to-docker-logstash-in-another-vm/197411/1 "2019-08-29T19:36:57Z")

</div>

LIke the title says, I have two VM's one has filebeat reading at a location, and the other has Logstash (and the rest of the ElasticSearch stack) on the other VM.

I've configured my filebeat to be:  
filebeat.inputs:

- type: log

output.logstash:  
hosts: ["IP of other VM:5044"]

logging:  
level: error  
to\_files: true  
files:  
path: /tmp  
name: fbeats.log  
keepfiles: 7  
rotateeverybytes: 10485760: log

and my logstash is configured to be:  
input {  
beats {  
port="5044"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["IP OF current VM:9200"]  
index =\> "some index"  
}  
}

However, when I fire up kibana, I am getting that elasticsearch has no data. I believe this is because filebeat is not sending data to the logstash in the other VM or that logstash is not sending data to elastic search (both logstash and elasticsearch are on the same VM)...

I added some logging to the filebeats, but I cannot find its' logs, either in the host VM or within the filebeat docker container.

Any help or direction is greatly appreciated. Thanks!

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [August 29, 2019, 7:57pm UTC](https://discuss.elastic.co/t/check-docker-filebeat-in-vm-is-sending-to-docker-logstash-in-another-vm/197411/2 "2019-08-29T19:57:49Z")

</div>

Hi @jeffery and welcome 🙂

It would help if you could edit your post and preformat the configuration as you find it in your files, you can do it by copying and pasting it, and using the preformatted text button in the toolbar `</>`.

To know where to find for the filebeat logs, please give some details on how you are running it. If you are running it with systemd logs will be available with `journalctl -u filebeat`, if you are running it with docker, logs will be available in `docker logs`, and in other cases logs will be in the `/var/log/filebeat` directory.  
In filebeat logs you will probably find the reason why filebeat is not collecting any log.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2019, 7:58pm UTC](https://discuss.elastic.co/t/check-docker-filebeat-in-vm-is-sending-to-docker-logstash-in-another-vm/197411/3 "2019-09-26T19:58:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.