# Need to gather the host logs , filebeat running as a container **URL:** \ **Category:** Beats\ **Tags:** docker, filebeat\ **Created:** [September 13, 2021, 4:37am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000 "2021-09-13T04:37:47Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 13, 2021, 4:37am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/1 "2021-09-13T04:37:47Z")
Hello Team, I am new to ELK and Filebeat. I have ELK stack running on one server using docker-compose. I have Filebeat running on another server as docker container 7.14.1. I have configured filebeat-docker.yml and I can see some logs at the Kibana dashboard which are coming within the containers. My question here is as I am running filebeat as a container, however I wanted to collect the application and system logs which are running on host not on the container. As the application running on host on which filebeat running as a docker container Is it possible? if yes, can you please guide/suggest me how to achieve it? Thank you in advance. Sabil. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 13, 2021, 5:37am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/2 "2021-09-13T05:37:45Z")
Welcome to our community! 😃 Generally you would install Filebeat directly on the host, that way you can monitor the host and any other containers it runs. Running Filebeat in a container and monitoring the underlying host is possible, you just need to make sure it has the relevant local filesystem points mounted inside the container. ---
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 13, 2021, 5:49am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/3 "2021-09-13T05:49:24Z")
@warkolm Thank you so much! 🙂 Let me try mounting the log path as volume in the filebeat container. Just to cross check, I will be executing the following command to mount the volumes. Hopefully is the correct way to do it. Please correct me if I am wrong. ```auto docker run -d \ --name=filebeat \ --user=root \ --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \ --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" \ --volume="/var/run/docker.sock:/var/run/docker.sock:ro" \ --volume="/var/log/apache2/error.log:/var/log/apache2/error.log:ro" --volume="/var/log/apache2/access.log:/var/log/apache2/xyz.log:ro" --volume="/var/log/apache2/dispatcher.log:/var/log/apache2/abc.log:ro" ``` Thank you. Sabil. ---
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 13, 2021, 7:03am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/4 "2021-09-13T07:03:51Z")
@warkolm I can see the volumes have been mounted by executing the above command. However, I am not getting that data in the Kibana dashboard. I am referring log.file.path in kibana dashboard. I can see only /var/lib/containers. Following info I am getting in filebeat logs. **INFO [input.harvester] log/harvester.go:340 File is inactive. Closing because close\_inactive of 5m0s reached.** Any suggestion and help would be appreciated. Thank you. Sabil. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 13, 2021, 7:19am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/5 "2021-09-13T07:19:34Z")
What does your Filebeat config look like? ---
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 13, 2021, 7:21am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/6 "2021-09-13T07:21:20Z")
Here is a filebeat-docker.yml file. ```auto filebeat.config: modules: path: ${path.config}/modules.d/*.yml reload.enabled: false filebeat.autodiscover: providers: - type: docker hints.enabled: true processors: - add_cloud_metadata: ~ filebeat.inputs: - type: log enabled: true paths: - /var/log/apache2/error.log - /var/log/apache2/access.log - /var/log/apache2/dispatcher.log - /var/log/aem/error.log include_lines: ['^ERR', '^WARN'] output.elasticsearch: hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}' ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 13, 2021, 7:23am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/7 "2021-09-13T07:23:47Z")
You're probably better off using the Apache module if you can - [Apache module | Filebeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-apache.html) ---
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 13, 2021, 7:32am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/8 "2021-09-13T07:32:56Z")
Sure, let me try adding apache module to config. Thank you! ---
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 13, 2021, 7:47am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/9 "2021-09-13T07:47:04Z")
@warkolm Sorry, but still getting the same. here is config file. ```auto filebeat.config: - modules: path: ${path.config}/modules.d/*.yml reload.enabled: false - module: apache access: enabled: true var.paths: ["/path/to/log/apache/access.log*"] error: enabled: true var.paths: ["/path/to/log/apache/error.log*"] filebeat.autodiscover: providers: - type: docker hints.enabled: true processors: - add_cloud_metadata: ~ filebeat.inputs: - type: log enabled: true paths: - /var/log/apache2/error.log - /var/log/apache2/access.log - /var/log/apache2/dispatcher.log - /var/log/aem/error.log include_lines: ['^ERR', '^WARN'] output.elasticsearch: hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}' ``` thank you. ---
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 14, 2021, 5:29am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/10 "2021-09-14T05:29:51Z")
@warkolm Any suggestion would be highly appreciated. Thank you. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 14, 2021, 6:11am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/11 "2021-09-14T06:11:02Z")
Can you try running with debug and seeing if that says anything? ---
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 14, 2021, 12:15pm UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/12 "2021-09-14T12:15:33Z")
@warkolm I am running the following command and not getting debug option while executing the following command. ```auto docker run -d \ --name=filebeat \ --user=root \ --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \ --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" \ --volume="/var/run/docker.sock:/var/run/docker.sock:ro" \ docker-public.docker.devstack.vwgroup.com/elastic/filebeat:7.14.1 -e -strict.perms=false ``` ---
**Author:** ![mohammed.sabil](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Post date:** [September 22, 2021, 10:44am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/13 "2021-09-22T10:44:40Z")
@warkolm I am able to get the logs on kinbana dashboard. Can you please suggest on how to filter the log data ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 20, 2021, 12:44pm UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000/14 "2021-10-20T12:44:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.