# Help With Validating This Filebeat Config

**URL:** <https://discuss.elastic.co/t/help-with-validating-this-filebeat-config/269164>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [April 4, 2021, 1:32am UTC](https://discuss.elastic.co/t/help-with-validating-this-filebeat-config/269164 "2021-04-04T01:32:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![LongBeachHXC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/longbeachhxc/32/85846_2.png) [@LongBeachHXC](https://discuss.elastic.co/u/LongBeachHXC)\
**Post date:** [April 4, 2021, 1:32am UTC](https://discuss.elastic.co/t/help-with-validating-this-filebeat-config/269164/1 "2021-04-04T01:32:57Z")

</div>

I am having the toughest time getting filebeat to send logs to my elastic stack. Am I missing something? I have heartbeat and metricbeat working. Filebeat is being fussy with me.

```auto
filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
filebeat.modules:
- module: system
  syslog:
    enabled: true
- module: elasticsearch
  server:
    enabled: true
  gc:
    enabled: true
  audit:
    enabled: true
  deprecation:
    enabled: true
- module: kibana
  log:
    enabled: true
  audit:
    enabled: true
processors:
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
setup.template.overwrite: true
# =================================== Kibana ===================================
setup.kibana:
  host: "${CONTAINER_KIBANA}:${PORT_KIBANA}"
  username: "${ELASTIC_KIBANA_SYSTEM_USER}"
  password: "${ELASTIC_KIBANA_SYSTEM_PASSWORD}"
  protocol: "https"
  ssl.enabled: true
  ssl.verification_mode: "certificate"
  ssl.certificate_authorities: 
    - '${CERTS_DIR}/ca/ca.crt'
  ssl.certificate: "${CERTS_DIR}/${CONTAINER_FILEBEAT}/${CONTAINER_FILEBEAT}.crt"
  ssl.key: "${CERTS_DIR}/${CONTAINER_FILEBEAT}/${CONTAINER_FILEBEAT}.key"
output.elasticsearch:
  hosts: ["${CONTAINER_ELASTIC_SEARCH}:${PORT_ELASTIC_SEARCH}"]
  username: "${ELASTIC_BEATS_SYSTEM_USER}"
  password: "${ELASTIC_BEATS_SYSTEM_PASSWORD}"
  protocol: "https"
  ssl.certificate: "${CERTS_DIR}/${CONTAINER_FILEBEAT}/${CONTAINER_FILEBEAT}.crt"
  ssl.key: "${CERTS_DIR}/${CONTAINER_FILEBEAT}/${CONTAINER_FILEBEAT}.key"
  ssl.certificate_authorities: 
    - "${CERTS_DIR}/ca/ca.crt"
  ssl.verification_mode: "certificate"
  ssl.enabled: true

filebeat:
    image: ${IMAGE_FILEBEAT:?IMAGE_FILEBEAT}:${FILEBEAT_VERSION:?FILEBEAT_VERSION}
    container_name: ${CONTAINER_FILEBEAT:?CONTAINER_FILEBEAT}
    user: root
    volumes:
      - "${PATH_ROOT}/conf/elk/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - elastic-certs:${ELASTIC_CERTS_DIR}
      - "/var/lib/docker/containers:/var/lib/docker/containers:ro"
      # - "/var/lib/docker/containers:/usr/share/filebeat/logs:ro"
    depends_on: 
      - ${CONTAINER_ELASTIC_SEARCH}01
      - ${CONTAINER_KIBANA}
    environment:
      CONTAINER_ELASTIC_SEARCH: ${CONTAINER_ELASTIC_SEARCH}01
      PORT_ELASTIC_SEARCH: ${PORT_ELASTIC_SEARCH}
      CONTAINER_KIBANA: ${CONTAINER_KIBANA}
      PORT_KIBANA: ${PORT_KIBANA}
      CERTS_DIR: ${ELASTIC_CERTS_DIR}
      CONTAINER_FILEBEAT: ${CONTAINER_FILEBEAT}
      ELASTIC_BEATS_SYSTEM_USER: ${ELASTIC_USER}
      ELASTIC_BEATS_SYSTEM_PASSWORD: ${ELASTIC_PASSWORD}
      ELASTIC_KIBANA_SYSTEM_USER: ${ELASTIC_USER}
      ELASTIC_KIBANA_SYSTEM_PASSWORD: ${ELASTIC_PASSWORD}
    networks:
      dotmusic_net:
        ipv4_address: ${DOCKER_IP_FILEBEAT:?DOCKER_IP_FILEBEAT}

es02:
    image: ${IMAGE_ELASTIC_SEARCH:?IMAGE_ELASTIC_SEARCH}:${ELASTIC_VERSION:?ELASTIC_VERSION}
    container_name: ${CONTAINER_ELASTIC_SEARCH:?CONTAINER_ELASTIC_SEARCH}02
    labels:
      co.elastic.logs/enabled: "true"
      co.elastic.logs/module: "elasticsearch"
      co.elastic.logs/fileset.stdout: access
      co.elastic.logs/fileset.stderr: error
    environment:
      - node.name=${CONTAINER_ELASTIC_SEARCH}02
      - cluster.name=${ELASTIC_CLUSTER_NAME:?ELASTIC_CLUSTER_NAME}
      - discovery.seed_hosts=${CONTAINER_ELASTIC_SEARCH}01,${CONTAINER_ELASTIC_SEARCH}03
      - cluster.initial_master_nodes=${CONTAINER_ELASTIC_SEARCH}01,${CONTAINER_ELASTIC_SEARCH}02,${CONTAINER_ELASTIC_SEARCH}03
      - bootstrap.memory_lock=true
      - ELASTIC_PASSWORD=$ELASTIC_BOOTSTRAP_PASSWORD
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - "xpack.security.enabled=true"
      - xpack.license.self_generated.type=basic
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=${ELASTIC_CERTS_DIR}/${CONTAINER_ELASTIC_SEARCH}02/${CONTAINER_ELASTIC_SEARCH}02.key
      - xpack.security.http.ssl.certificate_authorities=${ELASTIC_CERTS_DIR}/ca/ca.crt
      - xpack.security.http.ssl.certificate=${ELASTIC_CERTS_DIR}/${CONTAINER_ELASTIC_SEARCH}02/${CONTAINER_ELASTIC_SEARCH}02.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.certificate_authorities=${ELASTIC_CERTS_DIR}/ca/ca.crt
      - xpack.security.transport.ssl.certificate=${ELASTIC_CERTS_DIR}/${CONTAINER_ELASTIC_SEARCH}02/${CONTAINER_ELASTIC_SEARCH}02.crt
      - xpack.security.transport.ssl.key=${ELASTIC_CERTS_DIR}/${CONTAINER_ELASTIC_SEARCH}02/${CONTAINER_ELASTIC_SEARCH}02.key
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - "${PATH_ROOT}/conf/elk/99-sysctl.conf:/etc/sysctl.d/99-sysctl.conf"
      - data02:/usr/share/elasticsearch/data
      - elastic-certs:${ELASTIC_CERTS_DIR}
    networks:
      dotmusic_net:
        ipv4_address: ${DOCKER_IP_ELASTIC_2:?DOCKER_IP_ELASTIC_2}

```

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 8, 2021, 2:36am UTC](https://discuss.elastic.co/t/help-with-validating-this-filebeat-config/269164/2 "2021-04-08T02:36:18Z")

</div>

Can u post the logs from filebeat?? At first glance, the env car ur passing to filebeat ends with 01 but the name of ur es container is 02.

---

<div class="post-metadata">

**Author:** ![LongBeachHXC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/longbeachhxc/32/85846_2.png) [@LongBeachHXC](https://discuss.elastic.co/u/LongBeachHXC)\
**Post date:** [April 8, 2021, 3:19am UTC](https://discuss.elastic.co/t/help-with-validating-this-filebeat-config/269164/3 "2021-04-08T03:19:35Z")

</div>

so for further context, I have a three node elastic cluster. I have kibana running as well. I showed es02's config for the context of the autodiscovery hints. es01 is my primary node. The filebeat logs don't appear to show any errors, that I can tell. I can see the filebeat index in Kibana and it does appear documents are being sent to it. However, when I go to discover or logs I don't see anything for my es02 container.

```auto
Attaching to filebeat
filebeat | 2021-04-08T03:08:15.066Z INFO instance/beat.go:660 Home path: [/usr/share/filebeat] Config path: [/usr/share/filebeat] Data path: [/usr/share/filebeat/data] Logs path: [/usr/share/filebeat/logs]
filebeat | 2021-04-08T03:08:15.070Z INFO instance/beat.go:668 Beat ID: 7d967ca0-addd-4138-ae73-f964417e4153
filebeat | 2021-04-08T03:08:15.073Z INFO [add_cloud_metadata] add_cloud_metadata/add_cloud_metadata.go:101 add_cloud_metadata: hosting provider type not detected.
filebeat | 2021-04-08T03:08:15.089Z INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed
filebeat | 2021-04-08T03:08:15.089Z INFO [beat] instance/beat.go:996 Beat info {"system_info": {"beat": {"path": {"config": "/usr/share/filebeat", "data": "/usr/share/filebeat/data", "home": "/usr/share/filebeat", "logs": "/usr/share/filebeat/logs"}, "type": "filebeat", "uuid": "7d967ca0-addd-4138-ae73-f964417e4153"}}}
filebeat | 2021-04-08T03:08:15.089Z INFO [beat] instance/beat.go:1005 Build info {"system_info": {"build": {"commit": "08e20483a651ea5ad60115f68ff0e53e6360573a", "libbeat": "7.12.0", "time": "2021-03-18T06:16:51.000Z", "version": "7.12.0"}}}
filebeat | 2021-04-08T03:08:15.089Z INFO [beat] instance/beat.go:1008 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":12,"version":"go1.15.8"}}}
filebeat | 2021-04-08T03:08:15.090Z INFO [beat] instance/beat.go:1012 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2021-04-07T21:37:24Z","containerized":true,"name":"726d12a12558","ip":["127.0.0.1/8","172.25.0.13/24"],"kernel_version":"4.19.104-microsoft-standard","mac":["02:42:ac:19:00:0d"],"os":{"type":"linux","family":"redhat","platform":"centos","name":"CentOS Linux","version":"7 (Core)","major":7,"minor":9,"patch":2009,"codename":"Core"},"timezone":"UTC","timezone_offset_sec":0,"id":"44ccc339d95bd51386fcfc5d8f041927"}}}
filebeat | 2021-04-08T03:08:15.090Z INFO [beat] instance/beat.go:1041 Process info {"system_info": {"process": {"capabilities": {"inheritable":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"permitted":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"effective":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"bounding":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"ambient":null}, "cwd": "/usr/share/filebeat", "exe": "/usr/share/filebeat/filebeat", "name": "filebeat", "pid": 8, "ppid": 1, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2021-04-08T03:08:14.600Z"}}}
filebeat | 2021-04-08T03:08:15.090Z INFO instance/beat.go:304 Setup Beat: filebeat; Version: 7.12.0
filebeat | 2021-04-08T03:08:15.091Z INFO [index-management] idxmgmt/std.go:184 Set output.elasticsearch.index to 'filebeat-7.12.0' as ILM is enabled.
filebeat | 2021-04-08T03:08:15.091Z WARN [cfgwarn] tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
filebeat | 2021-04-08T03:08:15.092Z INFO eslegclient/connection.go:99 elasticsearch url: https://es01:9200
filebeat | 2021-04-08T03:08:15.093Z INFO [publisher] pipeline/module.go:113 Beat name: 726d12a12558
filebeat | 2021-04-08T03:08:15.098Z INFO beater/filebeat.go:117 Enabled modules/filesets: kibana (audit, log), (), system (auth, syslog), elasticsearch (audit, deprecation, gc, server, slowlog)
filebeat | 2021-04-08T03:08:15.101Z INFO [monitoring] log/log.go:117 Starting metrics logging every 30s
filebeat | 2021-04-08T03:08:15.101Z INFO instance/beat.go:468 filebeat start running.
filebeat | 2021-04-08T03:08:15.104Z INFO memlog/store.go:119 Loading data file of '/usr/share/filebeat/data/registry/filebeat' succeeded. Active transaction id=0
filebeat | 2021-04-08T03:08:15.104Z INFO memlog/store.go:124 Finished loading transaction log file for '/usr/share/filebeat/data/registry/filebeat'. Active transaction id=0
filebeat | 2021-04-08T03:08:15.104Z INFO [registrar] registrar/registrar.go:109 States Loaded from registrar: 0
filebeat | 2021-04-08T03:08:15.104Z INFO [crawler] beater/crawler.go:71 Loading Inputs: 10
filebeat | 2021-04-08T03:08:15.104Z WARN [cfgwarn] docker/input.go:49 DEPRECATED: 'docker' input deprecated. Use 'container' input instead. Will be removed in version: 8.0.0
filebeat | 2021-04-08T03:08:15.105Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/*/*.log]
filebeat | 2021-04-08T03:08:15.105Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 2482010575008624874)
filebeat | 2021-04-08T03:08:15.105Z INFO log/input.go:157 Configured paths: [/var/log/auth.log* /var/log/secure*]
filebeat | 2021-04-08T03:08:15.105Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 11991761552713575762)
filebeat | 2021-04-08T03:08:15.106Z INFO log/input.go:157 Configured paths: [/var/log/messages* /var/log/syslog*]
filebeat | 2021-04-08T03:08:15.106Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 7521169057727086769)
filebeat | 2021-04-08T03:08:15.106Z INFO log/input.go:157 Configured paths: [/var/log/elasticsearch/*.log /var/log/elasticsearch/*_server.json]
filebeat | 2021-04-08T03:08:15.106Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 10584868271925815388)
filebeat | 2021-04-08T03:08:15.106Z INFO log/input.go:157 Configured paths: [/var/log/elasticsearch/*_index_search_slowlog.log /var/log/elasticsearch/*_index_indexing_slowlog.log /var/log/elasticsearch/*_index_search_slowlog.json /var/log/elasticsearch/*_index_indexing_slowlog.json]
filebeat | 2021-04-08T03:08:15.107Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 6878571439949832352)
filebeat | 2021-04-08T03:08:15.108Z INFO log/input.go:157 Configured paths: [/var/log/elasticsearch/*_access.log /var/log/elasticsearch/*_audit.log /var/log/elasticsearch/*_audit.json]
filebeat | 2021-04-08T03:08:15.108Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 2322925157510133784)
filebeat | 2021-04-08T03:08:15.109Z INFO log/input.go:157 Configured paths: [/var/log/elasticsearch/*_deprecation.log /var/log/elasticsearch/*_deprecation.json]
filebeat | 2021-04-08T03:08:15.109Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 14614850079161566516)
filebeat | 2021-04-08T03:08:15.109Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/06c4421b670d776330c7e18b767afb1f615f9498bbd1a49a46619e4d9d715ec4/06c4421b670d776330c7e18b767afb1f615f9498bbd1a49a46619e4d9d715ec4-json.log
filebeat | 2021-04-08T03:08:15.109Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/723676c36414ac323759a60c14906c626b9c0e539e05f626ae9fc41c1d095606/723676c36414ac323759a60c14906c626b9c0e539e05f626ae9fc41c1d095606-json.log
filebeat | 2021-04-08T03:08:15.109Z INFO log/input.go:157 Configured paths: [/var/log/elasticsearch/gc.log.[0-9]* /var/log/elasticsearch/gc.log]
filebeat | 2021-04-08T03:08:15.109Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 11922003923008771421)
filebeat | 2021-04-08T03:08:15.109Z INFO log/input.go:157 Configured paths: [/var/log/kibana/*_audit.json]
filebeat | 2021-04-08T03:08:15.109Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 14651632209134346)
filebeat | 2021-04-08T03:08:15.109Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/72ecf3ae0802d69af5225c2e648fb110c8a5df16ad7533bf3ee45e3c4c8d2f91/72ecf3ae0802d69af5225c2e648fb110c8a5df16ad7533bf3ee45e3c4c8d2f91-json.log
filebeat | 2021-04-08T03:08:15.110Z INFO log/input.go:157 Configured paths: [/var/log/kibana/kibana.stdout]
filebeat | 2021-04-08T03:08:15.110Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 9913943773415849758)
filebeat | 2021-04-08T03:08:15.110Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/7ab3e7c8ca7333649306bb7e29349c778e26d4e5032dbf714776ceeaf342d766/7ab3e7c8ca7333649306bb7e29349c778e26d4e5032dbf714776ceeaf342d766-json.log
filebeat | 2021-04-08T03:08:15.110Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/353a91c46929e5590f50b40d37abc658579035d34ec5d64f296282a6d714fa2f/353a91c46929e5590f50b40d37abc658579035d34ec5d64f296282a6d714fa2f-json.log
filebeat | 2021-04-08T03:08:15.110Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/710c24f7146fd91ab1b611e8b1aa7bdb598fd4980f86d23bfe807546615f2b9e/710c24f7146fd91ab1b611e8b1aa7bdb598fd4980f86d23bfe807546615f2b9e-json.log
filebeat | 2021-04-08T03:08:15.110Z INFO [crawler] beater/crawler.go:108 Loading and starting Inputs completed. Enabled inputs: 10
filebeat | 2021-04-08T03:08:15.110Z INFO cfgfile/reload.go:164 Config reloader started
filebeat | 2021-04-08T03:08:15.110Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/c21a40bd2e179b6e23669ed165964500ff476e95ad3c632f3b3089141754d96b/c21a40bd2e179b6e23669ed165964500ff476e95ad3c632f3b3089141754d96b-json.log
filebeat | 2021-04-08T03:08:15.110Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/8a4e3b8bbeb4736f31e527d61da97f52cab9b5a04f6912059cd3ae8220c5db04/8a4e3b8bbeb4736f31e527d61da97f52cab9b5a04f6912059cd3ae8220c5db04-json.log
filebeat | 2021-04-08T03:08:15.110Z INFO cfgfile/reload.go:224 Loading of config files completed.
filebeat | 2021-04-08T03:08:15.110Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/c4e7e39e3f1feb5ec7f6249e5d6b9e1d48455e02f11529888fd01fdef6f24970/c4e7e39e3f1feb5ec7f6249e5d6b9e1d48455e02f11529888fd01fdef6f24970-json.log

```

---

<div class="post-metadata">

**Author:** ![LongBeachHXC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/longbeachhxc/32/85846_2.png) [@LongBeachHXC](https://discuss.elastic.co/u/LongBeachHXC)\
**Post date:** [April 8, 2021, 3:20am UTC](https://discuss.elastic.co/t/help-with-validating-this-filebeat-config/269164/4 "2021-04-08T03:20:17Z")

</div>

```auto
filebeat | 2021-04-08T03:08:15.111Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/ce2ac11b127257b10c90eced986efe3e5ed46d4e302d07451f9d21a349063eb2/ce2ac11b127257b10c90eced986efe3e5ed46d4e302d07451f9d21a349063eb2-json.log
filebeat | 2021-04-08T03:08:15.111Z INFO log/harvester.go:302 Harvester started for file: /var/lib/docker/containers/db384c064d01e009bff75e42059959e07abd8169af10a936c26906cf598df890/db384c064d01e009bff75e42059959e07abd8169af10a936c26906cf598df890-json.log
filebeat | 2021-04-08T03:08:15.125Z INFO [autodiscover] autodiscover/autodiscover.go:113 Starting autodiscover manager
filebeat | 2021-04-08T03:08:15.127Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/726d12a12558ee3df2bb1490dd55354784e23232ddaf9749a94f5cafaa804255/*-json.log]
filebeat | 2021-04-08T03:08:15.127Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/726d12a12558ee3df2bb1490dd55354784e23232ddaf9749a94f5cafaa804255/*-json.log]
filebeat | 2021-04-08T03:08:15.130Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.130Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.130Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.131Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.131Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.136Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.136Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.137Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.137Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.137Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.141Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.141Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.142Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.142Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.143Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat | 2021-04-08T03:08:15.143Z WARN [cfgwarn] tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
filebeat | 2021-04-08T03:08:15.143Z INFO eslegclient/connection.go:99 elasticsearch url: https://es01:9200
filebeat | 2021-04-08T03:08:15.220Z INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.12.0
filebeat | 2021-04-08T03:08:15.266Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/f9ff15e719dc5f42ec4c6cfa5cb9b830f4fe8d27a60bc908ab9b5393dc6865b2/*-json.log]
filebeat | 2021-04-08T03:08:15.267Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/f9ff15e719dc5f42ec4c6cfa5cb9b830f4fe8d27a60bc908ab9b5393dc6865b2/*-json.log]
filebeat | 2021-04-08T03:08:15.267Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/f9ff15e719dc5f42ec4c6cfa5cb9b830f4fe8d27a60bc908ab9b5393dc6865b2/*-json.log]
filebeat | 2021-04-08T03:08:15.270Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.271Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.271Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.272Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.272Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.275Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.275Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.275Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.276Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.276Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.280Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.280Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.280Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.281Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.281Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat | 2021-04-08T03:08:15.281Z WARN [cfgwarn] tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
filebeat | 2021-04-08T03:08:15.281Z INFO eslegclient/connection.go:99 elasticsearch url: https://es01:9200
filebeat | 2021-04-08T03:08:15.292Z INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.12.0
filebeat | 2021-04-08T03:08:15.341Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/3bb9a470584c24f7e2965935d4da03aa6d9c8e95998143593bd1ea0a3816018c/*-json.log]
filebeat | 2021-04-08T03:08:15.341Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/3bb9a470584c24f7e2965935d4da03aa6d9c8e95998143593bd1ea0a3816018c/*-json.log]
filebeat | 2021-04-08T03:08:15.343Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/3bb9a470584c24f7e2965935d4da03aa6d9c8e95998143593bd1ea0a3816018c/*-json.log]
filebeat | 2021-04-08T03:08:15.343Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/3bb9a470584c24f7e2965935d4da03aa6d9c8e95998143593bd1ea0a3816018c/*-json.log]
filebeat | 2021-04-08T03:08:15.343Z WARN [cfgwarn] tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
filebeat | 2021-04-08T03:08:15.344Z INFO eslegclient/connection.go:99 elasticsearch url: https://es01:9200
filebeat | 2021-04-08T03:08:15.355Z INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.12.0
filebeat | 2021-04-08T03:08:16.110Z INFO [publisher_pipeline_output] pipeline/output.go:143 Connecting to backoff(elasticsearch(https://es01:9200))
filebeat | 2021-04-08T03:08:16.110Z INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
filebeat | 2021-04-08T03:08:16.110Z INFO [publisher] pipeline/retry.go:223 done
filebeat | 2021-04-08T03:08:16.120Z INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.12.0
filebeat | 2021-04-08T03:08:16.142Z INFO [license] licenser/es_callback.go:51 Elasticsearch license: Basic
filebeat | 2021-04-08T03:08:16.145Z INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.12.0
filebeat | 2021-04-08T03:08:16.289Z INFO [index-management] idxmgmt/std.go:261 Auto ILM enable success.
filebeat | 2021-04-08T03:08:16.292Z INFO [index-management.ilm] ilm/std.go:139 do not generate ilm policy: exists=true, overwrite=false
filebeat | 2021-04-08T03:08:16.292Z INFO [index-management] idxmgmt/std.go:274 ILM policy successfully loaded.
filebeat | 2021-04-08T03:08:16.292Z INFO [index-management] idxmgmt/std.go:407 Set setup.template.name to '{filebeat-7.12.0 {now/d}-000001}' as ILM is enabled.
filebeat | 2021-04-08T03:08:16.292Z INFO [index-management] idxmgmt/std.go:412 Set setup.template.pattern to 'filebeat-7.12.0-*' as ILM is enabled.

```

---

<div class="post-metadata">

**Author:** ![LongBeachHXC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/longbeachhxc/32/85846_2.png) [@LongBeachHXC](https://discuss.elastic.co/u/LongBeachHXC)\
**Post date:** [April 8, 2021, 3:20am UTC](https://discuss.elastic.co/t/help-with-validating-this-filebeat-config/269164/5 "2021-04-08T03:20:40Z")

</div>

```auto
filebeat | 2021-04-08T03:08:16.292Z INFO [index-management] idxmgmt/std.go:446 Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.12.0 {now/d}-000001} as ILM is enabled.
filebeat | 2021-04-08T03:08:16.292Z INFO [index-management] idxmgmt/std.go:450 Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
filebeat | 2021-04-08T03:08:16.313Z INFO template/load.go:183 Existing template will be overwritten, as overwrite is enabled.
filebeat | 2021-04-08T03:08:17.170Z INFO template/load.go:117 Try loading template filebeat-7.12.0 to Elasticsearch
filebeat | 2021-04-08T03:08:17.494Z INFO template/load.go:109 template with name 'filebeat-7.12.0' loaded.
filebeat | 2021-04-08T03:08:17.494Z INFO [index-management] idxmgmt/std.go:298 Loaded index template.
filebeat | 2021-04-08T03:08:17.506Z INFO [index-management] idxmgmt/std.go:309 Write alias successfully generated.
filebeat | 2021-04-08T03:08:17.507Z INFO [publisher_pipeline_output] pipeline/output.go:151 Connection to backoff(elasticsearch(https://es01:9200)) established
filebeat | 2021-04-08T03:08:45.104Z INFO [monitoring] log/log.go:144 Non-zero 

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2021, 5:20am UTC](https://discuss.elastic.co/t/help-with-validating-this-filebeat-config/269164/6 "2021-05-06T05:20:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.