# Docker Beat with Docker ELK **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 13, 2017, 10:19am UTC](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333 "2017-09-13T10:19:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![domenicozingone](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@domenicozingone](https://discuss.elastic.co/u/domenicozingone)\ **Post date:** [September 13, 2017, 10:19am UTC](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333/1 "2017-09-13T10:19:41Z")
Hi, i have a docker container that is running filebeat container in on one host with an webpp an his logfile, and the docker ELK on other. i configure filebeat.yml : ``` filebeat.prospectors: - input_type: log paths: - /logs/*.log output.logstash: hosts: ["172.18.0.4:5000"] ``` IP address is the ip of the container that run logstash ``` docker ps: CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES b725172b6bf7 filebeat_filebeat "filebeat -e" 8 minutes ago Up 8 minutes 5000/tcp, 5044/tcp filebeat_filebeat_1 f7c1df5b872c dockerelk_logstash "/usr/local/bin/do..." About an hour ago Up About an hour 5044/tcp, 0.0.0.0:5000->5000/tcp, 9600/tcp dockerelk_logstash_1 9be1eb9a3599 dockerelk_kibana "/bin/sh -c /usr/l..." About an hour ago Up About an hour 0.0.0.0:5601->5601/tcp dockerelk_kibana_1 7fc7459e68aa dockerelk_elasticsearch "/bin/bash bin/es-..." About an hour ago Up About an hour 0.0.0.0:9200->9200/tcp, 0.0.0.0:9300->9300/tcp dockerelk_elasticsearch_1 64c46f119cb9 phpmyadmin/phpmyadmin "/run.sh phpmyadmin" 26 hours ago Up 26 hours 0.0.0.0:8080->80/tcp vtiger_vtiger_phpmyadmin_1 ``` logstash has 5000:5000 port mapped and 5044 only exposed With docker inspect i took the ip of logstash that i use in the filebeat.yml In the filebeat container i run the command: `./filebeat -e -c filebeat.yml -d "publish"` and i have this response: ``` 2017/09/13 10:12:42.605212 output.go:109: DBG output worker: publish 2039 events 2017/09/13 10:13:12.492870 metrics.go:39: INFO Non-zero metrics in the last 30s: filebeat.harvester.open_files=1 filebeat.harvester.running=1 filebeat.harvester.started=1 libbeat.publisher.published_events=2039 2017/09/13 10:13:12.605776 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 172.18.0.4:5000: i/o timeout 2017/09/13 10:13:42.492704 metrics.go:34: INFO No non-zero metrics in the last 30s 2017/09/13 10:13:43.606680 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 172.18.0.4:5000: i/o timeout 2017/09/13 10:14:12.492595 metrics.go:34: INFO No non-zero metrics in the last 30s 2017/09/13 10:14:15.607513 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 172.18.0.4:5000: i/o timeout ``` in the logstash/pipiline/logstash.conf with this config: ``` input { tcp { port => 5000 } } output { elasticsearch { hosts => "elasticsearch:9200" } } ``` but in filebeat has error and of course logstash don't pass anything to logstash... Please help me ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 13, 2017, 2:46pm UTC](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333/2 "2017-09-13T14:46:30Z")
> [@domenicozingone](#): > > hosts: ["localhost:5000"] `localhost` inside of the Filebeat container refers to the container itself and not the parent host running the container. You either need to - specify the IP/hostname of the docker host machine (this is possible because you have forwarded port 5000 from the LS container) - or link the filebeat and logstash containers such that you can directly communicate to the LS container from the FB container (this is probably how LS, ES, and Kibana are all communicating) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 13, 2017, 2:52pm UTC](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333/3 "2017-09-13T14:52:38Z")
BTW You might want to have a look at the [elastic/stack-docker](https://github.com/elastic/stack-docker) demo project. It uses docker-compose to run the whole Elastic stack. ---
**Author:** ![domenicozingone](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@domenicozingone](https://discuss.elastic.co/u/domenicozingone)\ **Post date:** [September 13, 2017, 3:16pm UTC](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333/4 "2017-09-13T15:16:11Z")
sorry this is an old screenshot ---
**Author:** ![domenicozingone](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@domenicozingone](https://discuss.elastic.co/u/domenicozingone)\ **Post date:** [September 13, 2017, 3:17pm UTC](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333/5 "2017-09-13T15:17:25Z")
i saw it i have the elk stack up an i installed filebeat on vtiger host to load the log file through Logstash ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 4, 2017, 10:19am UTC](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333/6 "2017-10-04T10:19:50Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.