# Filebeat running as a container not displaying logs in Kibana **URL:** \ **Category:** Beats\ **Tags:** docker, filebeat\ **Created:** [December 6, 2022, 11:21pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626 "2022-12-06T23:21:42Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Anagha\_nambiar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anagha_nambiar/32/97593_2.png) [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Post date:** [December 6, 2022, 11:21pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/1 "2022-12-06T23:21:42Z")
We are running filebeat:8.1.3 as a docker container using docker-compose file in Linux RHEL machine. We have provided the input type as filestream and provided the path for log files , but still it is not injecting any logs not displaying logs in Kibana. Could you please help on this? Filebeat.yml as below: -type: filestream id: test enabled: true paths: - /var/elk/test.log Docker-compose volume mounts: Volumes: - /var/run/docker.sock:/var/run/docker.sock - /var/lib/docker/containers/:/var/lib/docker/containers/:ro ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 7, 2022, 12:43am UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/2 "2022-12-07T00:43:59Z")
Hi @Anagha_nambiar Please do not `@` mention people directly in a thread that are not already in the thread, asking for help directly it is not community etiquette. This is a docker mounting issue ... much like in your last question about metricbeat you will need to bind mount the host file system that you want to collect logs from. A docker container can not see the host filesystem unless you bind mount it. something like ```auto volumes: - type: bind source: $HOST/location target: /container/location ``` Perhaps you should read up on docker and storage > **[Manage data in Docker](https://docs.docker.com/storage/)** > > Overview of persisting data in containers And Compose Syntax > **[Compose specification](https://docs.docker.com/compose/compose-file/#volumes)** > > Compose file reference ---
**Author:** ![Anagha\_nambiar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anagha_nambiar/32/97593_2.png) [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Post date:** [December 7, 2022, 1:46am UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/3 "2022-12-07T01:46:40Z")
Hi @stephenb , Sorry for that and thanks for letting me know. I have mentioned you because it was similar to metricbeat issue which you helped. I have already mounted the host and container filesystem details, which is mentioned in the details I mentioned above on docker- compose file. I am facing this issue even after that. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 7, 2022, 4:43am UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/4 "2022-12-07T04:43:53Z")
> [@Anagha\_nambiar](#): > > I have already mounted the host and container filesystem details, which is mentioned in the details I mentioned above on docker- compose file. No you did not You only mounted 2 specific files not the the logs.... > [@Anagha\_nambiar](#): > > - /var/elk/test.log No... That is not mounted or mapped to a host file location so it can not be read... Again you need to understand this from a docker perspective ... Something like... ```auto volumes: - type: bind source: $HOST/location/elk/test.log target: /var/elk/test.log ``` You need to understand docker and volume ---
**Author:** ![Anagha\_nambiar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anagha_nambiar/32/97593_2.png) [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Post date:** [December 7, 2022, 10:35am UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/5 "2022-12-07T10:35:53Z")
Okay, thank you @stephenb ---
**Author:** ![Anagha\_nambiar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anagha_nambiar/32/97593_2.png) [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Post date:** [December 7, 2022, 5:40pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/6 "2022-12-07T17:40:10Z")
Hi @stephenb , I have created a test.yml under filebeat/modules.d folder. Please find the test.yml below: -type: filestream Id: test Enabled: true Path: "/var/logs.log" Then mounted this test.yml in docker-compose yml file. But getting error like "could not create module registry for fileset" Could you please suggest on this? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 7, 2022, 6:51pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/7 "2022-12-07T18:51:34Z")
That is not a module... you need to put that `filestream` directly in the `filebeat.yml` you can not add files to the modules.d directory as far as I know that is not the intention that is a predefined set of modules. ---
**Author:** ![Anagha\_nambiar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anagha_nambiar/32/97593_2.png) [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Post date:** [December 7, 2022, 8:22pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/8 "2022-12-07T20:22:21Z")
Okay, got you @stephenb But we have many number of paths which needs to be monitored. It is difficult to put that directly in filebeat.yml as the file becomes huge. Could you please suggest any workaround? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 7, 2022, 8:36pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/9 "2022-12-07T20:36:20Z")
One container with many paths? Or Many containers with a few paths? > **[filestream input | Filebeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#filestream-input-paths)** > to fetch all files from a predefined level of subdirectories, the following pattern can be used: `/var/log/*/*.log`. You're probably going to need some form of automation/ scripting. And apologies, I can't really offer advice on that. ---
**Author:** ![Anagha\_nambiar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anagha_nambiar/32/97593_2.png) [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Post date:** [December 7, 2022, 8:41pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/10 "2022-12-07T20:41:54Z")
I am actually using filebeat container to check some of the paths which is in host filesystem. There are multiple paths under which different logs are present ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 7, 2022, 8:59pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/11 "2022-12-07T20:59:04Z")
> [@stephenb](#): > > `/var/log/*/*.log`. So mount the top filesystem path `/` and then list the paths individually or with `*` just like you would have to do if filebeat was just running directly on the host... You will still need to list the paths... no other way to do it something like. ```auto volumes: - type: bind source: / target: /hostrootfiles/ ``` ```auto paths: - /hostrootfiles/var/*/*.log ``` There is no "magic" there in fact perhaps you should try running filebeat NOT in docker first get it running then convert to docker... ---
**Author:** ![Anagha\_nambiar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anagha_nambiar/32/97593_2.png) [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Post date:** [December 7, 2022, 9:55pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/12 "2022-12-07T21:55:39Z")
Okay, thank you for confirming. I will try that. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 4, 2023, 11:56pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626/13 "2023-01-04T23:56:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.