# Filebeat Docker - Elasticsearch Host Issue

**URL:** <https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [November 29, 2022, 6:25pm UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083 "2022-11-29T18:25:51Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![mwsprotte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mwsprotte/32/113961_2.png) [@mwsprotte](https://discuss.elastic.co/u/mwsprotte)\
**Post date:** [November 29, 2022, 6:25pm UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/1 "2022-11-29T18:25:51Z")

</div>

Hello Everyone! I'm trying to run Filebeat in a Docker Container folowing this documentation: [https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html#\_run\_the\_filebeat\_setup](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html#_run_the_filebeat_setup) but in the second step, when I run the folowing comand:

```auto
docker run \
--net=elastic docker.elastic.co/beats/filebeat:7.17.4 \
setup -E setup.kibana.host=0.0.0.0:5601 \
-E output.elasticsearch.hosts=["https://0.0.0.0:9200"] 

```

I recieve this error:

> Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at [https://0.0.0.0:9200](https://0.0.0.0:9200): Get "[https://0.0.0.0:9200](https://0.0.0.0:9200)": dial tcp 0.0.0.0:9200: connect: connection refused]

My Elasticsearch are already running in Docker and these are my hosts (by docker ps):

- Elasticsearch: 0.0.0.0:9200
- Kibana: 0.0.0.0:5061

Does anyone know the reason for this error?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 29, 2022, 6:51pm UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/2 "2022-11-29T18:51:15Z")

</div>

Hi @mwsprotte Welcome to the community!

Docker Networking Issue not Elastic...

> <https://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach>

Another explanation

> **[How to Connect to Localhost Within a Docker Container](https://www.howtogeek.com/devops/how-to-connect-to-localhost-within-a-docker-container/)**
>
> When working with Docker, you usually containerize the services that form your stack and use inter-container networking to communicate between them. Sometimes you might need a container to talk to a service on your host that hasn’t been...

Might be worth reading... if you are new to docker

> **[Networking overview](https://docs.docker.com/network/)**
>
> Overview of Docker networks and networking concepts

try using

`host.docker.internal`

```auto
docker run \
--net=elastic docker.elastic.co/beats/filebeat:7.17.4 \
setup -E setup.kibana.host=host.docker.internal:5601 \
-E output.elasticsearch.hosts=["https://host.docker.internal:9200"] 

```

---

<div class="post-metadata">

**Author:** ![mwsprotte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mwsprotte/32/113961_2.png) [@mwsprotte](https://discuss.elastic.co/u/mwsprotte)\
**Post date:** [November 29, 2022, 9:52pm UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/3 "2022-11-29T21:52:48Z")

</div>

Hi, @stephenb  
Using 'host.docker.internal' worked for me, thanks for this tip and the references!! 😃

---

<div class="post-metadata">

**Author:** ![AnkurYogi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankuryogi/32/121279_2.png) [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\
**Post date:** [December 8, 2022, 8:19am UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/4 "2022-12-08T08:19:15Z")

</div>

Hello @stephenb

I also received a similar error.

\</ docker run \

> [docker.elastic.co/beats/filebeat:8.5.2](http://docker.elastic.co/beats/filebeat:8.5.2)   
> setup -E setup.kibana.host=172.18.0.3.0:5601   
> -E output.elasticsearch.hosts=["172.18.0.2:9200"]

Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at [http://172.18.0.2:9200](http://172.18.0.2:9200): Get "[http://172.18.0.2:9200](http://172.18.0.2:9200)": context deadline exceeded] \>

AND

\</ Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at [https://192.168.1.6:9200](https://192.168.1.6:9200): Get "[https://192.168.1.6:9200](https://192.168.1.6:9200)": x509: certificate signed by unknown authority] \>

I tried the above method but didn't work.

---

<div class="post-metadata">

**Author:** ![mwsprotte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mwsprotte/32/113961_2.png) [@mwsprotte](https://discuss.elastic.co/u/mwsprotte)\
**Post date:** [December 9, 2022, 1:51pm UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/5 "2022-12-09T13:51:52Z")

</div>

Hello, @AnkurYogi  
I already had have this error. I solved this adding the line

```auto
-E output.elasticsearch.ssl.verification_mode="none" 

```

This makes skip the SSL verification.

---

<div class="post-metadata">

**Author:** ![AnkurYogi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankuryogi/32/121279_2.png) [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\
**Post date:** [December 14, 2022, 7:13am UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/6 "2022-12-14T07:13:56Z")

</div>

```auto
filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: true
    reload.period: 10s

filebeat.modules:
- module: checkpoint
  firewall:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9001
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - /var/log/*.log
processors:
- add_cloud_metadata: ~

output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
  username: '${ELASTICSEARCH_USERNAME:}'
  password: '${ELASTICSEARCH_PASSWORD:}'

```

This is my filebeat.docker.yml  
But the problem here is the 9001 port isn't listening on the local server to receive the logs.  
Any hint on why the udp port isn't running ?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 14, 2022, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/7 "2022-12-14T15:18:04Z")

</div>

This is a docker item... you need to map the port see [here](https://docs.docker.com/config/containers/container-networking/)

something like add `-p 9001:9001`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2023, 5:18pm UTC](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/8 "2023-01-11T17:18:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.