# Metricbeat Docker Autodiscover Not Working - ELK

**URL:** https://discuss.elastic.co/t/metricbeat-docker-autodiscover-not-working-elk/219477
**Category:** Beats
**Tags:** metricbeat
**Created:** [February 15, 2020, 1:35pm UTC](https://discuss.elastic.co/t/metricbeat-docker-autodiscover-not-working-elk/219477 "2020-02-15T13:35:08Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![daz1761](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daz1761/32/61856_2.png) [@daz1761](https://discuss.elastic.co/u/daz1761)
#### Post date: [February 15, 2020, 1:35pm UTC](https://discuss.elastic.co/t/metricbeat-docker-autodiscover-not-working-elk/219477/1 "2020-02-15T13:35:08Z")

</div>

I have followed the `autodiscover` docs and my docker container is not being discovered by the service. In order for a container to be discovered, it needs to be labeled, so in order to check `docker-compose` labels were working, I inspected them and they are indeed present.

My `metricbeat.yml`:

```
metricbeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      hints.default_config.enabled: false
                         

# setup filebeat to send output to elasticsearch?
output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  index: "sample2-%{+YYYY.MM.dd}"

setup.template.name: "sample"
setup.template.pattern: "sample-*"

```

My `docker-compose.yml` (myloggingapp):

```
version: '3.7'
services:
  elasticsearch:
    container_name: elasticsearch
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
    ports:
      - 9200:9200
      - 9300:9300
    environment:
      - discovery.type=single-node
      - cluster.name=docker-
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    networks:
      - esnet
  filebeat:
    container_name: filebeat
    # needed to override user so we can access the log files, and docker.sock
    user: root
    image: myfilebeat:docker
    volumes:
      # needed to access all docker logs (read only) :
      - "/var/lib/docker/containers:/var/lib/docker/containers:ro"
      # needed to access additional informations about containers
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - esnet
  metricbeat:
    container_name: metricbeat
    # needed to override user so we can access the log files, and docker.sock
    user: root
    image: mymetricbeat:docker
    volumes:
      # needed to access all docker logs (read only) :
      - "/var/lib/docker/containers:/var/lib/docker/containers:ro"
      # needed to access additional informations about containers
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - esnet
  myloggingapp:
    container_name: loggingapp
    image: myloggingapp:docker
    labels:
      co.elastic.metrics/enabled: true
      co.elastic.metrics/module: 'docker'
      co.elastic.metrics/metricsets: 'cpu'
      co.elastic.metrics/hosts: 'unix:///var/run/docker.sock'
      co.elastic.metrics/period: '10s'
    networks:
      - esnet      
  elastichq:
    container_name: elastichq
    image: elastichq/elasticsearch-hq
    ports:
      - 8080:5000
    environment:
      - HQ_DEFAULT_URL=http://elasticsearch:9200
      - HQ_ENABLE_SSL=False
      - HQ_DEBUG=FALSE
    networks:
      - esnet  
networks:
  esnet:

```

The only thing I have read in the logs is a `WARN` which was:

> WARN docker/docker.go:63 BETA: The docker autodiscover is beta

Then the service doesn't seem to go any further than that and hence does not create a `metricbeat` index. I only get my `filebeat` index.

What am I doing wrong?

---

<div class="post-metadata">

### Author: ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [February 19, 2020, 5:43pm UTC](https://discuss.elastic.co/t/metricbeat-docker-autodiscover-not-working-elk/219477/2 "2020-02-19T17:43:51Z")

</div>

I think the problem is the value of the `co.elastic.metrics/hosts` label in your `loggingapp` container configuration. I think you want it to be `${data.host}:8080` See the documentation and examples on [https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-autodiscover-hints.html](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-autodiscover-hints.html).

Also, you can try running Metricbeat with the `logging.level: debug` configuration setting to get more details on what autodiscover is doing internally.

---

<div class="post-metadata">

### Author: ![daz1761](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daz1761/32/61856_2.png) [@daz1761](https://discuss.elastic.co/u/daz1761)
#### Post date: [February 25, 2020, 8:52am UTC](https://discuss.elastic.co/t/metricbeat-docker-autodiscover-not-working-elk/219477/3 "2020-02-25T08:52:25Z")

</div>

> [@shaunak](#):
>
> I think the problem is the value of the `co.elastic.metrics/hosts` label in your `loggingapp` container configuration. I think you want it to be `${data.host}:8080`

Thanks for the response, that doesn't make sense as it means everything needs to expose a port, which is not the case for my logging app, as it just logs messages (initially created to test Filebeat). So if your answer is correct, can I just use `${data.host}`?

> [@shaunak](#):
>
> Also, you can try running Metricbeat with the `logging.level: debug` configuration setting to get more details on what autodiscover is doing internally.

I will also try this too. Can this be set as an `env` variable like with Logstash?

Also, do I need to mount the containers `docker.sock` with the host `docker.sock` in `docker-compose`?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 24, 2020, 8:52am UTC](https://discuss.elastic.co/t/metricbeat-docker-autodiscover-not-working-elk/219477/4 "2020-03-24T08:52:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
