# Error when trying to run filebeat using docker-compose

**URL:** https://discuss.elastic.co/t/error-when-trying-to-run-filebeat-using-docker-compose/354388
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [February 28, 2024, 9:50pm UTC](https://discuss.elastic.co/t/error-when-trying-to-run-filebeat-using-docker-compose/354388 "2024-02-28T21:50:38Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![TflGustavo](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@TflGustavo](https://discuss.elastic.co/u/TflGustavo)
#### Post date: [February 28, 2024, 9:50pm UTC](https://discuss.elastic.co/t/error-when-trying-to-run-filebeat-using-docker-compose/354388/1 "2024-02-28T21:50:38Z")

</div>

I'm trying to run Elasticsearch, Kibana and Filebeat through docker-compose on Ubuntu. Elasticsearch and Kibana are starting normally, but Filebeat is giving an error in the filebeat.yml file.

I've already tried using different versions of Filebeat, but the problem remains the same.

Does anyone know how to solve it?

 ![Captura de tela de 2024-02-28 10-16-53](https://us1.discourse-cdn.com/elastic/original/3X/0/0/0023b9a2766119dafcce27250f3c79bc1f5d4d00.png)

**docker-compose.yml**

```auto
version: '3.8'

services:   
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.16.2
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      discovery.type: "single-node"
      ES_JAVA_OPTS: "-Xms2g -Xmx2g"
      xpack.monitoring.enabled: "true"
    volumes:
      - ./esdata:/usr/share/elasticsearch/data
      
  filebeat:
    image: docker.elastic.co/beats/filebeat:7.16.2
    build: filebeat
    entrypoint: "filebeat -e -strict.perms=false"
    container_name: filebeat
    restart: unless-stopped
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - ./logs:/usr/share/filebeat/logs:ro
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "2"
    depends_on:
      - elasticsearch
      
  kibana:
    image: docker.elastic.co/kibana/kibana:7.16.2
    restart: always
    ports:
      - "5601:5601"
    environment:
      ELASTICSEARCH_URL: http://elasticsearch:9200
    depends_on:
      - elasticsearch
      
volumes:
  esdata:
    driver: local

```

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 28, 2024, 10:01pm UTC](https://discuss.elastic.co/t/error-when-trying-to-run-filebeat-using-docker-compose/354388/2 "2024-02-28T22:01:32Z")

</div>

Hi @TflGustavo Welcome to the community...

1st please do not post images of text, they are hard to read (and some can not read them), can not be searched , debugged etc..

The error seems to be more of a docker mount issue than a filebeat issue...  
Take a close look at the docker volume mounts, is that a shared drive are there correct permissions etc.

---

<div class="post-metadata">

### Author: ![rtwolfe94022](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rtwolfe94022/32/132253_2.png) [@rtwolfe94022](https://discuss.elastic.co/u/rtwolfe94022)
#### Post date: [March 2, 2024, 1:01am UTC](https://discuss.elastic.co/t/error-when-trying-to-run-filebeat-using-docker-compose/354388/3 "2024-03-02T01:01:03Z")

</div>

[I put the image in my OCR server and pulled the text] I cannot guarantee that its a good answer:

The error indicates a problem with mounting the `filebeat.yml` file in the Filebeat container. Check the following:

1. The path to `filebeat.yml` on your host is correct and the file exists.
2. The `filebeat.yml` has proper permissions set and is readable.
3. The volume mount in your `docker-compose.yml` correctly maps the host file to the container file path, not a directory.
4. Restart Docker if necessary and ensure the Filebeat version is compatible with your ELK stack.
5. Use `docker logs` to check for more detailed errors after attempting to start Filebeat again.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 30, 2024, 3:01am UTC](https://discuss.elastic.co/t/error-when-trying-to-run-filebeat-using-docker-compose/354388/4 "2024-03-30T03:01:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
