# Filebeat Docker input: exclude container by name

**URL:** <https://discuss.elastic.co/t/filebeat-docker-input-exclude-container-by-name/304202>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [May 9, 2022, 2:21am UTC](https://discuss.elastic.co/t/filebeat-docker-input-exclude-container-by-name/304202 "2022-05-09T02:21:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alifsaddid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alifsaddid/32/105394_2.png) [@alifsaddid](https://discuss.elastic.co/u/alifsaddid)\
**Post date:** [May 9, 2022, 2:21am UTC](https://discuss.elastic.co/t/filebeat-docker-input-exclude-container-by-name/304202/1 "2022-05-09T02:21:37Z")

</div>

Hi, I am having a problem on configuring filebeat.  
I am running filebeat, logstash, Elasticsearch, and kibana on Docker. I want to retrieve logs of all existing containers, except from filebeat, logstash, Elasticsearch, and kibana.

I have tried so many attempts, reading other forums, stackoverflows, and the docs, but no matter what, the filebeat always retrieving kibana's logs.

I am using filebeat, logstash, Elasticsearch, and kibana version 7.16.2.

Here is my final filebeat config:

```auto
filebeat.inputs:
  - type: docker
    containers:
      path: "/usr/share/dockerlogs/data"
      stream: "stdout"
      ids:
        - "*"
      cri.parse_flags: true
      combine_partial: true

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      hints.default_config:
        type: container
        paths:
          - /var/log/containers/*-${data.container.id}.log
      templates:
        - config:
            - type: docker
              processors:
                - drop_event:
                    when:
                      or: 
                        - contains:
                            docker.container.name: "kibana"
                        - contains:
                            docker.container.name: "logstash"
                        - contains:
                            docker.container.name: "elasticsearch"
                        - contains:
                            docker.container.name: "filebeat"

processors:
  - add_docker_metadata:
      host: "unix:///var/run/docker.sock"

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

#----------------------------- Logstash output --------------------------------
output.logstash:
  hosts: ["logstash:5044"]

# Write Filebeat own logs only to file to avoid catching them with itself in docker log files
logging.level: error
logging.to_files: false
logging.to_syslog: false
loggins.metrice.enabled: false
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644
ssl.verification_mode: none

```

Any help will be highly appreciated! Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2022, 4:21am UTC](https://discuss.elastic.co/t/filebeat-docker-input-exclude-container-by-name/304202/2 "2022-06-06T04:21:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.