# Filebeat no collecting apache logs from containers in swarm **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 27, 2019, 7:47pm UTC](https://discuss.elastic.co/t/filebeat-no-collecting-apache-logs-from-containers-in-swarm/201460 "2019-09-27T19:47:34Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ndg](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@ndg](https://discuss.elastic.co/u/ndg)\ **Post date:** [September 27, 2019, 7:47pm UTC](https://discuss.elastic.co/t/filebeat-no-collecting-apache-logs-from-containers-in-swarm/201460/1 "2019-09-27T19:47:34Z")
Hi everyone! After a lot of work i managed to create the ELK in my system with everything (Kibana, Elasticsearch, Logstash, Metricbeat) and i am moving to the next step which is monitoring the apache logs from a Apache/PHP container. As a extra context, i have a Docker Swarm with a Manager and 2 Workers with both workers in Drain state for now. My issue is that i am creating a container with Filebeat that collects the log information from the containers in the host and i have a LAMP service that has a Apache-PHP container and a MariaDB container linked to each other. But even when i am monitoring the docker folder on the host, FIlebeat is not getting any apache metrics. My config files are as follows Filebeat service creation > ``` > docker service create \ > --name filebeat \ > --user=root \ > --mount type=bind,src=/home/repositories/ELK/filebeat/filebeat_2.yml,dst=/usr/share/filebeat/filebeat.yml \ > --mount type=bind,src=/home/repositories/ELK/filebeat/apache.yml,dst=/usr/share/filebeat/modules.d/apache.yml \ > --mount type=bind,src=/var/lib/docker/containers,dst=/var/lib/docker/containers,readonly \ > --mount type=bind,src=/var/run/docker.sock,dst=/var/run/docker.sock,readonly \ > --network elk_stack \ > --mode global \ > docker.elastic.co/beats/filebeat:7.3.2 > > ``` filebeat\_2.yml > ``` > filebeat.config: > modules: > path: ${path.config}/modules.d/*.yml > reload.enabled: false > > filebeat.autodiscover: > providers: > - type: docker > hints.enabled: true > > processors: > - add_docker_metadata: ~ > > output.logstash: > hosts: ["logstash:5044"] > > setup.kibana: > host: "kibana:5601" > > #setup.dashboards.enabled: true > > ``` apache.yml > ``` > # Module: apache > # Docs: https://www.elastic.co/guide/en/beats/filebeat/7.3/filebeat-module-apache.html > > - module: apache > # Access logs > access: > enabled: true > > # Set custom paths for the log files. If left empty, > # Filebeat will choose the paths depending on your OS. > var.paths: ["/var/lib/docker/containers/*/*.log"] > > # Error logs > error: > enabled: true > > # Set custom paths for the log files. If left empty, > # Filebeat will choose the paths depending on your OS. > var.paths: ["/var/lib/docker/containers/*/*.log"] > > ``` I see the module enable > Enabled: > apache > > Disabled: > apache > auditd > cisco > coredns > elasticsearch > envoyproxy > googlecloud > haproxy > icinga > iis > iptables > kafka > kibana > logstash > mongodb > mssql > mysql > nats > netflow > nginx > osquery > panw > postgresql > rabbitmq > redis > santa > suricata > system > traefik > zeek Apache service logs > ``` > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /favicon.ico HTTP/1.1" 200 1718 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdasdada" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /images/logoHelper.png HTTP/1.1" 304 192 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdasdada" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /?page=guest&action=index&correo=sdasdada HTTP/1.1" 200 1305 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdaad" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /images/logoHelper.png HTTP/1.1" 304 192 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdasdada" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /?page=guest&action=index&correo=sdasdada HTTP/1.1" 200 1305 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdaad" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /images/logoHelper.png HTTP/1.1" 304 192 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdasdada" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /?page=guest&action=index&correo=sdasdada HTTP/1.1" 200 1305 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdaad" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /images/logoHelper.png HTTP/1.1" 304 192 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdasdada" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /?page=guest&action=index&correo=sdasdada HTTP/1.1" 200 1305 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdaad" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:21 +0000] "GET /images/logoHelper.png HTTP/1.1" 304 192 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdasdada" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > centrodecontactos_poc.1.gzo8etdq00m6@MITLLDKR01 | 10.255.0.2 - - [26/Sep/2019:19:28:22 +0000] "GET /favicon.ico HTTP/1.1" 200 1717 "http://172.31.28.105:8081/?page=guest&action=index&correo=sdasdada" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" > > ``` ---
**Author:** ![ndg](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@ndg](https://discuss.elastic.co/u/ndg)\ **Post date:** [October 1, 2019, 1:01pm UTC](https://discuss.elastic.co/t/filebeat-no-collecting-apache-logs-from-containers-in-swarm/201460/2 "2019-10-01T13:01:59Z")
Hi everyone! Does anyone have any clue? I would like to fix this in order to advance with the developer of my Swarm POC. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 29, 2019, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-no-collecting-apache-logs-from-containers-in-swarm/201460/3 "2019-10-29T13:02:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.