# Filebeat.yml correct configuration on MAC OS - docker autodiscover -- Docker daemon at unix:///var/run/docker.sock

**URL:** <https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 11, 2021, 10:29am UTC](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923 "2021-03-11T10:29:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Automation\_Scripts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/automation_scripts/32/85374_2.png) [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\
**Post date:** [March 11, 2021, 10:29am UTC](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923/1 "2021-03-11T10:29:57Z")

</div>

Guys,

I am new to Docker. Am running Docker on my MAC. I've created on my docker-compose file this configuration:

```auto
    filebeat:
        depends_on:
          - kibana 
          - logstash
        container_name: filebeat 
        image: docker.elastic.co/beats/filebeat:${VERSION}
        volumes:
          - ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
          - /var/lib/docker/containers/:/var/lib/docker/containers/:ro
          - /var/run/docker.sock:/var/run/docker.sock:ro
        ports:
          - 8080:80
        networks:
          - elastic 

```

On my filebeat.yml I have this code:

```auto
    filebeat.autodiscover:
      providers:
        - type: docker
          hints.enabled: true
          labels.dedot: true

    output.logstash:
      hosts: logstash:5044

    logging.level: debug

```

What I am doing wrong?

The error is:

`> filebeat | Exiting: error in autodiscover provider settings: error setting up docker autodiscover provider: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?`

---

<div class="post-metadata">

**Author:** ![Automation\_Scripts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/automation_scripts/32/85374_2.png) [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\
**Post date:** [March 11, 2021, 8:01pm UTC](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923/2 "2021-03-11T20:01:58Z")

</div>

I solved my issue. Seems that you need to download the Docker from their site not to install it with homebrew. Also there is need to install virtualbox to run docker-machine ls.  
With some digging seems that on MAC Docker is partially installed. Learned a lesson, but still, those kind of things have to be explain on their site for begginers.

---

<div class="post-metadata">

**Author:** ![Joaquin\_menchaca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joaquin_menchaca/32/86209_2.png) [@Joaquin\_menchaca](https://discuss.elastic.co/u/Joaquin_menchaca)\
**Post date:** [March 28, 2021, 11:38pm UTC](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923/3 "2021-03-28T23:38:48Z")

</div>

There is a `cask` and `bottle` for docker. You need to install the cask for Docker Desktop. Even then, you will not have access /var/lib/docker as this is on the Linux VM that is needed to run the docker daemon. The socket is mounted into the VM from the host macOS so this should work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2021, 1:39am UTC](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923/4 "2021-04-26T01:39:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.