Docker filebeat autodiscover not detecting nginx logs

Elastic Stack Beats
2

Hi @Fachtna_Simi. welcome to the Elastic community forums!

Based on the documentation at https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html, https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html#_docker_2, and https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-docker.html the following configuration should work.

Keep your Dockerfile as-is.

Change your filebeat.yml to this:

filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - condition:
            contains:
              docker.container.image: nginx
          config:
            - module: nginx
              access:
                enabled: true
                input:
                  type: container
                  paths:
                    - /var/lib/docker/containers/${data.docker.container.id}/*.log
                  stream: stdout
              error:
                enabled: true
                input:
                  type: container
                  paths:
                    - /var/lib/docker/containers/${data.docker.container.id}/*.log
                  stream: stderr

output.console:
  pretty: true

And start up Filebeat like so:

sudo docker run -it -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/docker/containers/:/var/lib/docker/containers:ro filebeat

Hope that helps,

Shaunak