# Filebeat's journald input with paths for Podman Logs

**URL:** <https://discuss.elastic.co/t/filebeats-journald-input-with-paths-for-podman-logs/379831>\
**Category:** Beats\
**Tags:** docker\
**Created:** [July 6, 2025, 1:10pm UTC](https://discuss.elastic.co/t/filebeats-journald-input-with-paths-for-podman-logs/379831 "2025-07-06T13:10:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexandrosprey](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@alexandrosprey](https://discuss.elastic.co/u/alexandrosprey)\
**Post date:** [July 6, 2025, 1:10pm UTC](https://discuss.elastic.co/t/filebeats-journald-input-with-paths-for-podman-logs/379831/1 "2025-07-06T13:10:58Z")

</div>

I'm trying to spin up log collection on Linux Fedora 42 in docker compose (via podman).  
Podman doesn't write logs to files, so I chose journalctl

```auto
filebeat.inputs:
  - type: journald
    id: "podman-logs"
    # explicitly tell Filebeat where your journals live:
    paths:
      - /var/log/journal/

logging.level: debug

output.console:
  pretty: true

```

`docker compose run --rm filebeat01 sh -c "journalctl -D /var/log/journal"`

indeed starts output of long journal and it seems /var/log/journal mounted alright in container

but filebeat still gives me errors like

> Journalctl wrote to stderr: Failed to open files: Is a directory\n

> cannot read from journalctl stderr: read |0: file already closed

> reader error: 'no more data to read, journalctl exited unexpectedly, exit code: 1', restarting...

> Blockquote

what exactly paths argument expects?