I don't see any value add in your answer by repeating the obvious. Yes, I checked the website documentation and understand what should happen. The question relates to why it is not. The problem was really with my docker volume mapping. I set it to -v - /opt/logstash/lastrun:/opt/logstash/lastrun. Docker processes files and directories differently.