Filebeat on RHEL7: Docker input not showing up in Kibana

Elastic Stack Beats
,
1

I first set up and installed Filebeat, using RPM, on a Red Hat Linux VM with a plain filestream input, with path set to /var/log/redist_6379.log. I then ran sudo service filebeat start and verified I can see log output in Kibana Discover.

I then set up and installed Filebeat with RPM on a RHEL7 VM running 2 Docker containers. I configured the input as follows:

filebeat.inputs:
- type: container
  enabled: true
  paths:
    - '/var/lib/docker/containers/*/*.log'

I then ran sudo service filebeat start to start it.

Problem: No docker log output in Kibana discover

I ran this to look at the log sudo journalctl -u filebeat.service --since "5 minutes ago" | less but did not see anything to indicate what might be wrong.

Is filebeat.autodiscover required?

2

Hi @paolovalladolid,

Did you check if log files in this path exists:

/var/lib/docker/containers/*/*.log

?
Did you try to add debug log level logging.level: debug, maybe it could provide more details?

3

Hi! I just found out that the Docker container I want to monitor was set up to log to journald instead of the file system, so I will try the journald input in Filebeat.

4

Confirming the journald input solved my issue