# Filebeat with Docker mounted logs handle restart duplicates

**URL:** https://discuss.elastic.co/t/filebeat-with-docker-mounted-logs-handle-restart-duplicates/139711
**Category:** Beats
**Created:** [July 12, 2018, 9:32am UTC](https://discuss.elastic.co/t/filebeat-with-docker-mounted-logs-handle-restart-duplicates/139711 "2018-07-12T09:32:18Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Rob\_Davidson](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@Rob\_Davidson](https://discuss.elastic.co/u/Rob_Davidson)
#### Post date: [July 12, 2018, 9:32am UTC](https://discuss.elastic.co/t/filebeat-with-docker-mounted-logs-handle-restart-duplicates/139711/1 "2018-07-12T09:32:18Z")

</div>

Im currently sending logs via a mounted volume.

**docker-compose.yml** looks like the following

```
version: '3'
services:
  filebeat:
    image: docker.elastic.co/beats/filebeat:6.3.0
    container_name: filebeat
    volumes:
      - '/var/log/logstash/:/mnt/log:ro'
      - './config/filebeat.yml:/usr/share/filebeat/filebeat.yml'
    restart: always
    network_mode: "host"

```

**filebeat.yml** looks like this

```
filebeat.prospectors:
- input_type: log
  paths:
    - /mnt/log/*.log
  json.overwrite_keys: true
  json.keys_under_root: true
  fields_under_root: true

output.logstash:
  hosts: ['localhost:5044']

```

Now the logs are generated by spring boot which will delete old logs after x amount of days. My concern is If I restart the machine or run a new container it will resend all the same logs.

Can I mount the filebeat "tracker file" or whatever it is called? So that it will persist reboots. Or is there another mechanism that will do the same thing?

Also did a search and this question has been asked before.. However couldnt really work out a solution based on the answers  
[https://discuss.elastic.co/t/filebeat-persist-processed-logs-if-docker-container-crashes/60089](https://discuss.elastic.co/t/filebeat-persist-processed-logs-if-docker-container-crashes/60089)

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [July 12, 2018, 2:48pm UTC](https://discuss.elastic.co/t/filebeat-with-docker-mounted-logs-handle-restart-duplicates/139711/2 "2018-07-12T14:48:28Z")

</div>

I would recommend you to create a volume for the registry file which is inside the Filebeat `data` directory as you suggested. Point the data directory to this volume and mount it into your Filebeat container. So if the Filebeat container stops you can just start one up again and continue reading.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 9, 2018, 4:48pm UTC](https://discuss.elastic.co/t/filebeat-with-docker-mounted-logs-handle-restart-duplicates/139711/3 "2018-08-09T16:48:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
