# Filebeat daemon

**URL:** https://discuss.elastic.co/t/filebeat-daemon/301777
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [April 6, 2022, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-daemon/301777 "2022-04-06T14:44:22Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![The-morpho](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@The-morpho](https://discuss.elastic.co/u/The-morpho)
#### Post date: [April 6, 2022, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-daemon/301777/1 "2022-04-06T14:44:23Z")

</div>

Hello ,

I want to get filebeat on docker, i followed the instructions here : [How to run Filebeat with Docker and use it with ELK stack](https://www.robertobandini.it/2021/02/07/how-to-run-filebeat-with-docker-and-use-it-with-elk-stack/)

But when i try to run the Filebeat container using this configuration :

`docker run -d --name=filebeat --user=root --network=` `"host"` `--volume=` `"$HOME/test-filebeat:/logs"` `--volume=` `"$HOME/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro"` `docker.elastic.co` `/beats/filebeat` `:7.10.2 filebeat -e --strict.perms=` `false`

I get this error:

docker: Error response from daemon: create $HOME/test-filebeat: "$HOME/test-filebeat" includes invalid characters for a local volume name, only "[a-zA-Z0-9][a-zA-Z0-9\_.-]" are allowed. If you intended to pass a host directory, use absolute path.  
See 'docker run --help'.

If you can help me i will be grateful.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 6, 2022, 3:25pm UTC](https://discuss.elastic.co/t/filebeat-daemon/301777/2 "2022-04-06T15:25:38Z")

</div>

did you try putting in the full path instead of `$HOME`

Also for reference here is the official documentation  
Current

> **[Run Filebeat on Docker | Filebeat Reference \[8.1\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html)**

7.10

> **[Run Filebeat on Docker | Filebeat Reference \[7.10\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.10/running-on-docker.html)**

---

<div class="post-metadata">

### Author: ![The-morpho](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@The-morpho](https://discuss.elastic.co/u/The-morpho)
#### Post date: [April 7, 2022, 11:13am UTC](https://discuss.elastic.co/t/filebeat-daemon/301777/3 "2022-04-07T11:13:56Z")

</div>

Thanks @stephenb for your reply, i mention the full path but Filebeat container doesn't running together the ELK stack .

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5a94f075857bd170dccadea34d07034eba4a1d6.png)

and when i check if the log was loaded, i got this error

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6bae5544c750de32afc22f3e0857f2c6150e0380.png)

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 7, 2022, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-daemon/301777/4 "2022-04-07T13:57:16Z")

</div>

Please don't post pictures the can not always be viewed by everyone and can not be searched

That error means you have a syntax error in one of the yml files. You will need to share them to help.

Again I would suggest following our official docs instead of someone else's blog

---

<div class="post-metadata">

### Author: ![The-morpho](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@The-morpho](https://discuss.elastic.co/u/The-morpho)
#### Post date: [April 7, 2022, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-daemon/301777/5 "2022-04-07T13:59:26Z")

</div>

Thanks for your help.

Sorry about the pictures.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 5, 2022, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-daemon/301777/6 "2022-05-05T16:00:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
