# Filebeat Docker Container can't read host log files due to permissions **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 10, 2017, 3:35am UTC](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952 "2017-12-10T03:35:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![claflico](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@claflico](https://discuss.elastic.co/u/claflico)\ **Post date:** [December 10, 2017, 3:35am UTC](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952/1 "2017-12-10T03:35:15Z")
Trying to setup an ELK:6.0.1 stack and \*beat:6.0.1 via CentOS 7, Docker 17.09, & Rancher 1.6.12 for a presentation I'm giving this week at a DevOps MeetUp. Am trying to set everything up without having to create custom images or mounting custom config files like I usually have to. Using the following guides: > **[elastic/beats-docker](https://github.com/elastic/beats-docker)** > > beats-docker - Official Beats Docker images [https://www.elastic.co/guide/en/beats/filebeat/6.0/running-on-docker.html](https://www.elastic.co/guide/en/beats/filebeat/6.0/running-on-docker.html) [https://www.elastic.co/guide/en/beats/filebeat/6.0/configuration-filebeat-modules.html](https://www.elastic.co/guide/en/beats/filebeat/6.0/configuration-filebeat-modules.html) My docker-compose section: filebeat: image: [docker.elastic.co/beats/filebeat:6.0.1](http://docker.elastic.co/beats/filebeat:6.0.1) environment: output.logstash.hosts: '["logstash:5044"]' volumes: - /etc/localtime:/etc/localtime:ro - /var/log:/mnt/log:ro command: - -e - --modules - system labels: io.rancher.container.hostname\_override: container\_name io.rancher.container.pull\_image: always io.rancher.scheduler.global: 'true' From the containers default prospector file: - input\_type: log paths: - /mnt/log/\*.log When I look at the container logs I'm seeing: 12/9/2017 6:33:19 PM2017/12/10 00:33:19.608840 prospector.go:426: ERR Harvester could not be started on new file: /mnt/log/boot.log, Err: Error setting up harvester: Harvester setup failed. Unexpected file opening error: Failed opening /mnt/log/boot.log: open /mnt/log/boot.log: permission denied 12/9/2017 6:33:19 PM2017/12/10 00:33:19.608958 prospector.go:426: ERR Harvester could not be started on new file: /mnt/log/yum.log, Err: Error setting up harvester: Harvester setup failed. Unexpected file opening error: Failed opening /mnt/log/yum.log: open /mnt/log/yum.log: permission denied 12/9/2017 6:33:29 PM2017/12/10 00:33:29.609752 prospector.go:426: ERR Harvester could not be started on new file: /mnt/log/boot.log, Err: Error setting up harvester: Harvester setup failed. Unexpected file opening error: Failed opening /mnt/log/boot.log: open /mnt/log/boot.log: permission denied 12/9/2017 6:33:29 PM2017/12/10 00:33:29.609887 prospector.go:426: ERR Harvester could not be started on new file: /mnt/log/yum.log, Err: Error setting up harvester: Harvester setup failed. Unexpected file opening error: Failed opening /mnt/log/yum.log: open /mnt/log/yum.log: permission denied Without rebuilding the filebeat image and setting the user to root how can I give the container access to the log files owned by root? I've already set the container to privileged mode in Rancher and that didn't help. ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [December 11, 2017, 3:10pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952/2 "2017-12-11T15:10:00Z")
> [@claflico](#): > > Am trying to set everything up without having to create custom images or mounting custom config files like I usually have to That's a good approach 🙂 So far I've been setting user to root, when using plain Docker you can use `--user` flag. How are you launching it with Rancher?, probably it has a similar parameter you can pass. Best regards ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [December 11, 2017, 3:25pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952/3 "2017-12-11T15:25:01Z")
Sorry, I just saw you are using docker-compose, just pass the `user: root` field ---
**Author:** ![claflico](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@claflico](https://discuss.elastic.co/u/claflico)\ **Post date:** [December 11, 2017, 3:46pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952/4 "2017-12-11T15:46:08Z")
Ok, thanks...i'll try adding that. ---
**Author:** ![claflico](https://avatars.discourse-cdn.com/v4/letter/c/71c47a/32.png) [@claflico](https://discuss.elastic.co/u/claflico)\ **Post date:** [December 12, 2017, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952/5 "2017-12-12T16:07:41Z")
That worked...thanks again. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 9, 2018, 4:09pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952/6 "2018-01-09T16:09:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.