# Filebeat fails to send docker container logs to Logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 4, 2018, 12:31pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-send-docker-container-logs-to-logstash/134419 "2018-06-04T12:31:13Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Dolores](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@Dolores](https://discuss.elastic.co/u/Dolores)\ **Post date:** [June 4, 2018, 12:31pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-send-docker-container-logs-to-logstash/134419/1 "2018-06-04T12:31:13Z")
I have a custom image of filebeat, and I am trying to forward all docker container logs to logstash and later on to see them on Kibana (through Elasticsearch). I can't see what am I doing wrong, as I cant see any logs on Kibana. I have these configurations: Filebeat Dockerfile: ``` FROM docker.elastic.co/beats/filebeat:6.2.4 COPY filebeat.yml /usr/share/filebeat/filebeat.yml USER root RUN chown filebeat /usr/share/filebeat/filebeat.yml USER filebeat ``` filebeat.yml: filebeat.prospectors: - type: log enabled: true paths: - /var/lib/docker/containers/_/_.log document\_type: docker json.message\_key: log ``` output.logstash: hosts: ["logstash:5044"] ``` logstash.conf: input { beats { port =\> 5044 } } output { elasticsearch { hosts =\> "elasticsearch:9200" index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" } } And filebeat logs (I'm getting this most of the time ): {"log":"2018-06-04T12:24:36.397Z\u0009INFO\u0009[monitoring]\u0009log/log.go:124\u0009Non-zero metrics in the last 30s\u0009{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":110,"time":110},"total":{"ticks":250,"time":258,"value":250},"user":{"ticks":140,"time":148}},"info":{"ephemeral\_id":"adbf12dd-cc46-43a2-8e43-edd8e17ac1aa","uptime":{"ms":750020}},"memstats":{"gc\_next":4194304,"memory\_alloc":1717080,"memory\_total":7613320,"rss":-966656}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"load":{"1":0.72,"15":0.94,"5":0.8,"norm":{"1":0.18,"15":0.235,"5":0.2}}}}}}\n","stream":"stderr","time":"2018-06-04T12:24:36.397835494Z"} {"log":"2018-06-04T12:25:06.400Z\u0009INFO\u0009[monitoring]\u0009log/log.go:124\u0009Non-zero metrics in the last 30s\u0009{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":110,"time":113},"total":{"ticks":260,"time":266,"value":260},"user":{"ticks":150,"time":153}},"info":{"ephemeral\_id":"adbf12dd-cc46-43a2-8e43-edd8e17ac1aa","uptime":{"ms":780020}},"memstats":{"gc\_next":4194304,"memory\_alloc":1909160,"memory\_total":7805400}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"load":{"1":1.94,"15":1.04,"5":1.09,"norm":{"1":0.485,"15":0.26,"5":0.2725}}}}}}\n","stream":"stderr","time":"2018-06-04T12:25:06.401824994Z"} {"log":"2018-06-04T12:25:36.399Z\u0009INFO\u0009[monitoring]\u0009log/log.go:124\u0009Non-zero metrics in the last 30s\u0009{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":110,"time":113},"total":{"ticks":270,"time":275,"value":270},"user":{"ticks":160,"time":162}},"info":{"ephemeral\_id":"adbf12dd-cc46-43a2-8e43-edd8e17ac1aa","uptime":{"ms":810022}},"memstats":{"gc\_next":4194304,"memory\_alloc":1400072,"memory\_total":8093248}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"load":{"1":1.94,"15":1.07,"5":1.19,"norm":{"1":0.485,"15":0.2675,"5":0.2975}}}}}}\n","stream":"stderr","time":"2018-06-04T12:25:36.40051431Z"} ---
**Author:** ![Dolores](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@Dolores](https://discuss.elastic.co/u/Dolores)\ **Post date:** [June 4, 2018, 12:44pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-send-docker-container-logs-to-logstash/134419/2 "2018-06-04T12:44:14Z")
I also tried with this: filebeat.yml: filebeat.prospectors: - type: docker containers.ids: - '\*' output.logstash: hosts: ["logstash:5044"] ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [June 4, 2018, 7:31pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-send-docker-container-logs-to-logstash/134419/3 "2018-06-04T19:31:50Z")
As you use 6.2, you could use the docker prospector type: [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html) This should make configuration easier. ---
**Author:** ![Dolores](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@Dolores](https://discuss.elastic.co/u/Dolores)\ **Post date:** [June 6, 2018, 2:59pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-send-docker-container-logs-to-logstash/134419/5 "2018-06-06T14:59:50Z")
I only needed to change Dockerfile to: FROM [docker.elastic.co/beats/filebeat:6.2.4](http://docker.elastic.co/beats/filebeat:6.2.4) COPY filebeat.yml /usr/share/filebeat/filebeat.yml USER root As I had issues with file permissions, check this for more info: [Collecting logfiles of Docker containers with filebeat running as Docker container](https://discuss.elastic.co/t/collecting-logfiles-of-docker-containers-with-filebeat-running-as-docker-container/77548) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2018, 3:00pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-send-docker-container-logs-to-logstash/134419/6 "2018-07-04T15:00:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.