# Filebeat on Docker Swarm

**URL:** <https://discuss.elastic.co/t/filebeat-on-docker-swarm/356330>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [March 27, 2024, 7:27pm UTC](https://discuss.elastic.co/t/filebeat-on-docker-swarm/356330 "2024-03-27T19:27:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bobus](https://avatars.discourse-cdn.com/v4/letter/b/e9bcb4/32.png) [@bobus](https://discuss.elastic.co/u/bobus)\
**Post date:** [March 27, 2024, 7:27pm UTC](https://discuss.elastic.co/t/filebeat-on-docker-swarm/356330/1 "2024-03-27T19:27:11Z")

</div>

Running version 8.12 on Docker Swarm, I want to export all logs from this swarm to a Logstash-type input that runs on Graylog. After a day of work I got data into Graylog but with very, very few fields. I'm guessing that there are members here who have been doing this for years and may be willing to share their config with me.

My current filebeat.yml is:

```auto
filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - config:
            - type: container
              containers.ids:
                - "${data.docker.container.id}"
              paths:
                - "/var/lib/docker/containers/${data.docker.container.id}/*.log"
              fields_under_root: true
      processors:
        - add_host_metadata: ~
        - add_docker_metadata: ~
        - decode_json_fields:
            fields: ["message"]
            target: ""
            overwrite_keys: true
            add_error_key: true

output.logstash:
  hosts: ["192.168.194.59:12211"]

```

In Graylog I see no docker or host data, and the "message" field appears in pure JSON, i.e. it is not parsed as I'd expect.

Please give me a nudge in the right direction, I'm sure my config has lots of room for improvement.

This question is purely about Filebeat; Graylog is my own concern.

---

<div class="post-metadata">

**Author:** ![bobus](https://avatars.discourse-cdn.com/v4/letter/b/e9bcb4/32.png) [@bobus](https://discuss.elastic.co/u/bobus)\
**Post date:** [March 28, 2024, 9:20pm UTC](https://discuss.elastic.co/t/filebeat-on-docker-swarm/356330/2 "2024-03-28T21:20:35Z")

</div>

I see no replies, I wonder if it's because this scenario is not even feasible...

Perhaps FluentD is a more promising solution...?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2024, 11:21pm UTC](https://discuss.elastic.co/t/filebeat-on-docker-swarm/356330/3 "2024-04-25T23:21:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.