# Filbeat with docker compose

**URL:** <https://discuss.elastic.co/t/filbeat-with-docker-compose/214728>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 12, 2020, 12:24pm UTC](https://discuss.elastic.co/t/filbeat-with-docker-compose/214728 "2020-01-12T12:24:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Haritz\_Saiz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haritz_saiz/32/60669_2.png) [@Haritz\_Saiz](https://discuss.elastic.co/u/Haritz_Saiz)\
**Post date:** [January 12, 2020, 12:24pm UTC](https://discuss.elastic.co/t/filbeat-with-docker-compose/214728/1 "2020-01-12T12:24:28Z")

</div>

Hello everyone

I am trying to send the generated logs by cowrie to logstash:

Here is my docker compose:

```
version: '3'
volumes:
  cowrie-etc:
    driver: local
  cowrie-var:
    driver: local
services:
  cowrie:
    container_name: cowrie      
    restart: always
    build:
      context: .
      dockerfile: ./cowrie/Dockerfile

    ports:
      - "2222:2222"
      - "2223:2223"
    volumes:
      - cowrie-etc:/cowrie/cowrie-git/etc
      - cowrie-var:/cowrie/cowrie-git/var/log/cowrie

  filebeat:
    image: docker.elastic.co/beats/filebeat:7.5.1
    container_name: filebeat      
    user: root
    volumes:
      - ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - cowrie-var:/data/cowrie:ro
      - /home/ubuntu/demo/:/data/cowrie:ro

    environment:
      - LOGSTASH_HOST='${LOGSTASH_HOST}'
    command: ["--strict.perms=false"]
    networks:
      - docker_elk

networks:
  docker_elk:
    driver: bridge

```

And this is my filebeat.yml config file:

```
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /data/cowrie/*.log
      - /data/cowrie/*.json*

output:
  #logstash:
  # hosts: ["${LOGSTASH_HOST}"]
  # bulk_max_size: 1024
  # username: "elastic"
  # password: "password"

  console:
    pretty: true

```

When I run the containers, filebeat doesnt seam to work as it doesnt print any log. Dont have any clue of why it is not working. The container is up.

Hope anyone can help me.

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [January 13, 2020, 6:38pm UTC](https://discuss.elastic.co/t/filbeat-with-docker-compose/214728/2 "2020-01-13T18:38:14Z")

</div>

Can you verify that the Cowrie logs are present in the mount inside the Filebeat container?

```auto
docker exec -it filebeat ls -al /data/cowrie

```

If they are present as expected, then could you _temporarily_ add `logging.level: debug` to your `filebeat.yml` config file and restart the Filebeat container? Then please post the first 100 lines or so of your Filebeat container logs, after masking out any sensitive information.

Thanks,

Shaunak

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 10, 2020, 6:41pm UTC](https://discuss.elastic.co/t/filbeat-with-docker-compose/214728/3 "2020-02-10T18:41:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.