# Running filebeat as ECS daemon
**URL:** https://discuss.elastic.co/t/running-filebeat-as-ecs-daemon/224958
**Category:** Beats
**Tags:** filebeat
**Created:** [March 25, 2020, 9:00am UTC](https://discuss.elastic.co/t/running-filebeat-as-ecs-daemon/224958 "2020-03-25T09:00:57Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Alexander\_Popov](https://discuss.elastic.co/u/Alexander_Popov)
#### Post date: [March 25, 2020, 9:00am UTC](https://discuss.elastic.co/t/running-filebeat-as-ecs-daemon/224958/1 "2020-03-25T09:00:57Z")
I want to run filebeat as AWS ECS [daemon](https://docs.aws.amazon.com/AmazonECS/latest/userguide/ecs_services.html#service_scheduler_daemon)
My plan is to attach volume in filebeat daemon as `/var/log/app`
and same volumes in all app containers.
Each container will write logs in `/var/log/app/$container_id` folder
questions:
1. is my plan ok? or there is better solutions?
2. can I expose folder ($container\_id) name as additional parameter when sending logs?
---
### Author:  [@ConorTier](https://discuss.elastic.co/u/ConorTier)
#### Post date: [March 25, 2020, 9:07am UTC](https://discuss.elastic.co/t/running-filebeat-as-ecs-daemon/224958/2 "2020-03-25T09:07:02Z")
hey perhaps see my description of a setup
if daemon and 3 nodes in cluster then 3 filebeat instances all reading from 1 volumn - could be a problem, and daemon will have root access to node but not pods files as far ias i know - my testing
> [@Filebeats Kubernetes File close due to inactive of 5min](https://discuss.elastic.co/t/filebeats-kubernetes-file-close-due-to-inactive-of-5min/224855/2):
>
> Little more background in case it helps - Microservices created in .net core - using log4net logging - file appender - this should not matter as its just creating a something.log file with a specific format for each log output. Havent changed the scan\_frequency - default is 10 seconds and close\_inactive is still at its default - (5 mintues) In theory once a log entry is entered every 10 minutes as example - it should appear to filebeat output every 10 minutes and 10 seconds - note logs dont co…
---
### Author:  [@Alexander\_Popov](https://discuss.elastic.co/u/Alexander_Popov)
#### Post date: [March 25, 2020, 2:49pm UTC](https://discuss.elastic.co/t/running-filebeat-as-ecs-daemon/224958/3 "2020-03-25T14:49:44Z")
daemon runs one per instance not a container
so If have 3 instances and 3 containers up on each instance in cluster - total 9 containers
I will have 3 filebeat instances each have own volume mounted to host directory
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 22, 2020, 2:49pm UTC](https://discuss.elastic.co/t/running-filebeat-as-ecs-daemon/224958/4 "2020-04-22T14:49:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.