# How to use logstash with docker?

**URL:** https://discuss.elastic.co/t/how-to-use-logstash-with-docker/253638
**Category:** Logstash
**Tags:** docker
**Created:** [October 29, 2020, 3:14am UTC](https://discuss.elastic.co/t/how-to-use-logstash-with-docker/253638 "2020-10-29T03:14:43Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![mohhef](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohhef/32/78045_2.png) [@mohhef](https://discuss.elastic.co/u/mohhef)
#### Post date: [October 29, 2020, 3:14am UTC](https://discuss.elastic.co/t/how-to-use-logstash-with-docker/253638/1 "2020-10-29T03:14:44Z")

</div>

Hello,

My enviroment:  
Host: windows 10  
Containers: linux

I am building a spring boot application and I am logging my logs to "C:/elk/spring-boot-elk.log"  
I want to have a docker setup such that logstash will be able to read from that file whenever it is updated. I have no idea how should I proceed with this.

my docker file:

```auto
version: "3.3"
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    ports:
      - 9200:9200
    networks:
      - elknetwork

  kibana:
    container_name: kibana
    image: docker.elastic.co/kibana/kibana:7.9.3
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200 # address of elasticsearch docker container which kibana will connect
    ports:
      - 5601:5601
    depends_on:
      - elasticsearch # kibana will start when elasticsearch has started
    networks:
      - elknetwork

  logstash:
    image: logstash:7.9.3
    container_name: logstash
    links:
      - elasticsearch:elasticsearch
    volumes:
      - ./:/config-dir
    command: logstash -f /config-dir/logstash.conf
    depends_on:
      - elasticsearch
    networks:
      - elknetwork

networks:
  elknetwork:
    driver: bridge

volumes:
  elasticsearch-data:

```

my logstash.conf file

```auto
input {
  file {
    type => "java"
    path => "C:/elk/spring-boot-elk.log"
    start_position => "beginning"
    codec => multiline {
      pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.*"
      negate => "true"
      what => "previous"
    }
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
  }
}

```

however when running the docker containers, i get this error:

```auto
 [2020-10-29T02:59:02,245][ERROR][logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=>#<ArgumentError: File paths must be absolute, relative path specified: C:/elk/spring-boot-elk.log>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.2.2/lib/logstash/inputs/file.rb:283:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.2.2/lib/logstash/inputs/file.rb:281:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:386:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:311:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in `block in start'"], "pipeline.sources"=>["/config-dir/logstash.conf"], :thread=>"#<Thread:0x4fcfe8a8 run>"}

```

my guess is that logstash can't read the log file because logstash is running on a docker container and thus it will not be able to see my host file.

---

<div class="post-metadata">

### Author: ![Iker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iker/32/91708_2.png) [@Iker](https://discuss.elastic.co/u/Iker)
#### Post date: [October 29, 2020, 6:01am UTC](https://discuss.elastic.co/t/how-to-use-logstash-with-docker/253638/2 "2020-10-29T06:01:14Z")

</div>

You are right, you need to map the volume to the container with the specific file or folder; for example:

 ![Screenshot 2020-10-29 010019](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44844d87fc4040e6733f7af9df961731f6dfe206.png)

---

<div class="post-metadata">

### Author: ![mohhef](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohhef/32/78045_2.png) [@mohhef](https://discuss.elastic.co/u/mohhef)
#### Post date: [October 29, 2020, 8:31pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-with-docker/253638/3 "2020-10-29T20:31:22Z")

</div>

> [@mohhef](#):
>
> ```auto
> depends_on:
> 
> ```

Thank you for your reply,  
I am a bit new to docker but from my understanding. When you mount a volume, you transfer the files from the host to the docker container. Is that correct?

What if I want to keep logging to my log file on the host and I want docker to also have the updated log files?

---

<div class="post-metadata">

### Author: ![Iker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iker/32/91708_2.png) [@Iker](https://discuss.elastic.co/u/Iker)
#### Post date: [October 29, 2020, 9:20pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-with-docker/253638/4 "2020-10-29T21:20:49Z")

</div>

It doesn't work like that, there are two main ways to use "Volumes"

1. "Volumes": The volume is in your disk as a file, the container see the volume as a folder in an specific path (Mount point), the host can't see the volume contents directly.
2. "Bind Mount": You create a volume that binds directly to a file or folder on the host, the container see the volume as a folder or a file in a specific path (Mount Point), the host can access directly the volume and modify his content, these changes can be seen by the container in real time.

> **[Manage data in Docker](https://docs.docker.com/storage/)**
>
> Overview of persisting data in containers

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 26, 2020, 9:20pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-with-docker/253638/5 "2020-11-26T21:20:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.