# Filebeat container config
**URL:** https://discuss.elastic.co/t/filebeat-container-config/73574
**Category:** Beats
**Tags:** filebeat
**Created:** [February 1, 2017, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-container-config/73574 "2017-02-01T18:59:28Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@DougD](https://discuss.elastic.co/u/DougD)
#### Post date: [February 1, 2017, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-container-config/73574/1 "2017-02-01T18:59:28Z")
Greetings,
I'm new to filebeat and trying to understand how to setup a filebeat container to process the logs from several application containers each creating logs at /app/log/\*.log
Will this work?
docker run -d -v /app/log --name FB filebeat-image
docker run -d --volumes-from FB --name APP1 app-image
docker run -d --volumes-from FB --name APP2 app-image
OR
docker run -v /app/log --name APP1 app-image
docker run -v /app/log --name APP2 app-image
docker run --volumes-from APP1 --volumes-from APP2 --name FB filebeat-image
OR
what is the best practice?
Thank you,
Doug
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [February 2, 2017, 8:06am UTC](https://discuss.elastic.co/t/filebeat-container-config/73574/2 "2017-02-02T08:06:45Z")
I personally would recommend approach one because it works with dynamically adding and removing containers. In your second version you already need to know all containers on start up.
The version I would recommend is to write logs to somewhere on the host machine and mount this into a filebeat container so the logs are not "linked" to any container directly.
---
### Author:  [@nsphaniraj](https://discuss.elastic.co/u/nsphaniraj)
#### Post date: [February 6, 2017, 6:03pm UTC](https://discuss.elastic.co/t/filebeat-container-config/73574/3 "2017-02-06T18:03:35Z")
What happens to the state of the file when the filebeat container restarts? Does the newly created/restarted container resumes harvesting the file from where it has left?
**Example** :
Suppose, i start filebeat container and the container harvests 5 lines of log data i.e. /var/log/elasticsearch/elasticsearch.log of the host machine where the container is running. The filebeat container crashes/restarts. When the filebeat container is back, does the harvesting happens from 6th line?
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [February 7, 2017, 3:57pm UTC](https://discuss.elastic.co/t/filebeat-container-config/73574/4 "2017-02-07T15:57:12Z")
This depends on where you store the registry file. If the registry file is on a volume that you will reuse, then it will continue. If the registry file disappears with the container, then not.
---
### Author:  [@nsphaniraj](https://discuss.elastic.co/u/nsphaniraj)
#### Post date: [February 7, 2017, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-container-config/73574/5 "2017-02-07T16:23:45Z")
Hi ruflin,
It makes more sense to resume from where it has halted. At least in my scenario. How do we control the location of registry file?
Appreciate it!
Thanks
Phaniraj
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [February 8, 2017, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-container-config/73574/6 "2017-02-08T13:21:13Z")
See [https://www.elastic.co/guide/en/beats/filebeat/5.2/configuration-global-options.html#\_registry\_file](https://www.elastic.co/guide/en/beats/filebeat/5.2/configuration-global-options.html#_registry_file)
---
### Author:  [@nsphaniraj](https://discuss.elastic.co/u/nsphaniraj)
#### Post date: [February 16, 2017, 6:13am UTC](https://discuss.elastic.co/t/filebeat-container-config/73574/7 "2017-02-16T06:13:33Z")
Thanks ruflin,
I will map the container registry\_file value to host location.
Appreciate your help!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2017, 6:13am UTC](https://discuss.elastic.co/t/filebeat-container-config/73574/8 "2017-03-16T06:13:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.