# Filebeat config to read logs using docker

**URL:** <https://discuss.elastic.co/t/filebeat-config-to-read-logs-using-docker/213672>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [January 3, 2020, 7:29am UTC](https://discuss.elastic.co/t/filebeat-config-to-read-logs-using-docker/213672 "2020-01-03T07:29:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Praveen\_V](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveen_v/32/60224_2.png) [@Praveen\_V](https://discuss.elastic.co/u/Praveen_V)\
**Post date:** [January 3, 2020, 7:29am UTC](https://discuss.elastic.co/t/filebeat-config-to-read-logs-using-docker/213672/1 "2020-01-03T07:29:44Z")

</div>

Am able to run the filebeat via docker , however the output says log is taken.. i dont see any data in elastic , any suggestions would be helpful.  
thanks

Command User

ocker run --rm --name filebeat --volume="/usr/share/filebeat/data/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro" --volume="/var/run/docker.sock:/var/run/docker.sock:ro" --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" --network host -e -strict.perms=false container/beats/filebeat:7.5.0

Output:

2020-01-03T07:28:55.909Z INFO instance/beat.go:297 Setup Beat: filebeat; Version: 7.5.0  
2020-01-03T07:28:55.909Z INFO [index-management] idxmgmt/std.go:182 Set output.elasticsearch.index to 'filebeat-7.5.0' as ILM is enabled.  
2020-01-03T07:28:55.909Z INFO elasticsearch/client.go:171 Elasticsearch url: [http://10.24.89.106:9200](http://10.24.89.106:9200)  
2020-01-03T07:28:55.910Z INFO [publisher] pipeline/module.go:97 Beat name: [a302-2550-4074.ldn.swissbank.com](http://a302-2550-4074.ldn.swissbank.com)  
2020-01-03T07:28:55.911Z INFO instance/beat.go:429 filebeat start running.  
2020-01-03T07:28:55.911Z INFO registrar/migrate.go:104 No registry home found. Create: /usr/share/filebeat/data/registry/filebeat  
2020-01-03T07:28:55.911Z INFO registrar/migrate.go:112 Initialize registry meta file  
2020-01-03T07:28:55.912Z INFO registrar/registrar.go:108 No registry file found under: /usr/share/filebeat/data/registry/filebeat/data.json. Creating a new registry file.  
2020-01-03T07:28:55.912Z INFO [monitoring] log/log.go:118 Starting metrics logging every 30s  
2020-01-03T07:28:55.914Z INFO registrar/registrar.go:145 Loading registrar data from /usr/share/filebeat/data/registry/filebeat/data.json  
2020-01-03T07:28:55.914Z INFO registrar/registrar.go:152 States Loaded from registrar: 0  
2020-01-03T07:28:55.914Z INFO crawler/crawler.go:72 Loading Inputs: 1  
2020-01-03T07:28:55.914Z INFO log/input.go:152 Configured paths: [/app/test/logs/app\_auto\*.log]  
2020-01-03T07:28:55.914Z INFO input/input.go:114 Starting input of type: log; ID: 3140521193032836508  
2020-01-03T07:28:55.914Z INFO crawler/crawler.go:106 Loading and starting Inputs completed. Enabled inputs: 1

Filebeat.yaml

filebeat.inputs:

- type: log  
enabled: true  
paths:
  - /app/test/logs/app\_auto\*.log

output.elasticsearch:  
hosts: ["HOST:9200"]

---

<div class="post-metadata">

**Author:** ![Alex\_Kristiansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_kristiansen/32/46086_2.png) [@Alex\_Kristiansen](https://discuss.elastic.co/u/Alex_Kristiansen)\
**Post date:** [January 3, 2020, 4:49pm UTC](https://discuss.elastic.co/t/filebeat-config-to-read-logs-using-docker/213672/2 "2020-01-03T16:49:57Z")

</div>

@Praveen_V,

Are you sure you have the permissions needed to read the files in that directory? Can you try re-running filebeat with `-d '*'` and see if there's any additional debug logs?

---

<div class="post-metadata">

**Author:** ![Praveen\_V](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveen_v/32/60224_2.png) [@Praveen\_V](https://discuss.elastic.co/u/Praveen_V)\
**Post date:** [January 6, 2020, 6:50am UTC](https://discuss.elastic.co/t/filebeat-config-to-read-logs-using-docker/213672/3 "2020-01-06T06:50:18Z")

</div>

@Alex_Kristiansen . Thanks for the reply

Was able to achieve using direct Linux install of Filebeat , rather than Dockers.  
However am trying to extract the time field from the log message , can you help to point me towards any link where this issue was sorted.

Sample data in the message field of Elastic : "2019-12-23 03:38 +00:00: Session not loaded"

Thanks agian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 3, 2020, 6:50am UTC](https://discuss.elastic.co/t/filebeat-config-to-read-logs-using-docker/213672/4 "2020-02-03T06:50:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.