# Data stream in filebeat 8.1.0

**URL:** https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [November 22, 2022, 11:54pm UTC](https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596 "2022-11-22T23:54:47Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)
#### Post date: [November 22, 2022, 11:54pm UTC](https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596/1 "2022-11-22T23:54:47Z")

</div>

Hi I'm using filebeat in 8.1.0 on docker below is my filebeat.yml  
But I'm able to reach data stream option how i should enable it?  
The second thing how to under docker image force enable dedicated module for example apache or tomcat for input file?

```auto
filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

# filestream is an input for collecting log messages from files.
- type: filestream
  id: my-filestream

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/localhost_access_log.txt
  fields:
    tomcat: true

#---------------------------- Apache Tomcat Module ----------------------------
#- module: tomcat
# log:
# enabled: true

    # Set which input to use between udp (default), tcp or file.
    # var.input: udp
    # var.syslog_host: localhost
    # var.syslog_port: 9501

    # Set paths for the log files when file input is used.
# var.paths:
# - /var/log/localhost_access_log.txt

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: true

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

setup.template.name: "filebeat-tomcat"
setup.template.pattern: "filebeat-tomcat*"
setup.ilm.enabled: true
setup.template.settings:
  index.number_of_shards: 6

#setup.dashboards.enabled: true

setup.kibana.host: ""
setup.kibana.ssl.enabled: false
setup.kibana.ssl.certificate_authorities: ["/usr/share/elasticsearch/config/certificates2/ca.crt"]
setup.kibana.ssl.certificate: "/usr/share/elasticsearch/config/certificates2/private.key"
setup.kibana.ssl.key: "/usr/share/elasticsearch/config/certificates2/private.key"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
# - add_cloud_metadata: ~
  - add_docker_metadata: ~
# - add_kubernetes_metadata: ~

logging.level: debug

output.elasticsearch:
  hosts: []
  username: ''
  password: ''
  index: "filebeat-_t"

```

---

<div class="post-metadata">

### Author: ![Tetiana\_Kravchenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tetiana_kravchenko/32/102683_2.png) [@Tetiana\_Kravchenko](https://discuss.elastic.co/u/Tetiana_Kravchenko)
#### Post date: [November 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596/2 "2022-11-24T10:35:46Z")

</div>

Hi @INS ,

From you configuration - It seems you are using [hints based autodiscovery](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html):

```auto
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

```

note that in this case you should add labels to the docker containers you want get logs from: `The hints system looks for hints in Kubernetes Pod annotations or Docker labels that have the prefix co.elastic.logs.`  
To enable some specific module you can add `co.elastic.logs/module: apache` label to docker labels.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 22, 2022, 12:35pm UTC](https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596/3 "2022-12-22T12:35:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.