Minimal filebeat config: syslog -> file

In an attempt to walk before running I thought I'd set up a filebeat instance as a syslog server and then use logger to send log messages to it.

My Docker Compose configuration for setting up filebeat is

  stdin_open: true
  tty: true
  command: filebeat -v -c /config-dir/filebeat.yml
  restart: always
    - "5000:5000"
    - ./log-cfg/filebeat.yml:/config-dir/filebeat.yml
    - ./beat-out/:/beat-out/

The file filebeat.yml contains

  - type: syslog "localhost:5000"

output.file.path: "/beat-out"

  level: debug
  to_files: true

Bringing up filebeat with docker-compose up filebeat succeeds. And sending log messages using logger --server localhost --port 5000 --tcp --rfc3164 "An error" succeeds too. However, there is nothing printed to any file in ./beat-out/.

Attaching to the running instance and inspecting the log (/usr/share/filebeat/logs/filebeat) doesn't help me understand what's missing. A log can be found at Also, nothing appears in the filebeat log when sending a syslog message with logger.

What am I missing here?

The syslog input is being bound to the container's loopback interface. Just need to remove the host name: ":5000"

1 Like

Indeed! Thanks!

I do wonder what answered logger when it tried to connect to port 5000 locally...

That was docker itself. If you try to connect to a bound port that is closed inside the container, docker will still accept the connection and then close it immediately.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.