Filebeat on RHEL7: Docker input not showing up in Kibana

I first set up and installed Filebeat, using RPM, on a Red Hat Linux VM with a plain filestream input, with path set to /var/log/redist_6379.log. I then ran sudo service filebeat start and verified I can see log output in Kibana Discover.

I then set up and installed Filebeat with RPM on a RHEL7 VM running 2 Docker containers. I configured the input as follows:

filebeat.inputs:
- type: container
  enabled: true
  paths:
    - '/var/lib/docker/containers/*/*.log'

I then ran sudo service filebeat start to start it.

Problem: No docker log output in Kibana discover

I ran this to look at the log sudo journalctl -u filebeat.service --since "5 minutes ago" | less but did not see anything to indicate what might be wrong.

Is filebeat.autodiscover required?

Hi @paolovalladolid,

Did you check if log files in this path exists:

/var/lib/docker/containers/*/*.log

?
Did you try to add debug log level logging.level: debug, maybe it could provide more details?

Hi! I just found out that the Docker container I want to monitor was set up to log to journald instead of the file system, so I will try the journald input in Filebeat.

Confirming the journald input solved my issue

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.