# Dockerized Filebeat monitor mounted host syslog
**URL:** https://discuss.elastic.co/t/dockerized-filebeat-monitor-mounted-host-syslog/261923
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [January 22, 2021, 2:07pm UTC](https://discuss.elastic.co/t/dockerized-filebeat-monitor-mounted-host-syslog/261923 "2021-01-22T14:07:25Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@d01](https://discuss.elastic.co/u/d01)
#### Post date: [January 22, 2021, 2:07pm UTC](https://discuss.elastic.co/t/dockerized-filebeat-monitor-mounted-host-syslog/261923/1 "2021-01-22T14:07:25Z")
I have filebeat set up along elasticsearch, logstash, kibana and other containers in docker using a docker-compose file. To monitor the host with this filebeat instance as well, I have the host `/var/log/syslog` mounted into the container under the same path. It uses the system module to parse the logs and send them to logstash
```auto
filebeat:
config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
modules:
- module: system
```
It is working for some time, but then just stops (I assume when the log is rotated).
Filebeat frequently logs `"File is inactive: /var/log/syslog. Closing because close_inactive of 5m0s reached."` and always starts a new harvester until at some point it doesn't. I thought the `close_inactive` setting might help, but that does not seem to be available for system.
I'd be grateful for any ideas or pointers!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 19, 2021, 4:07pm UTC](https://discuss.elastic.co/t/dockerized-filebeat-monitor-mounted-host-syslog/261923/2 "2021-02-19T16:07:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.