# Unable to configure filebeat to send to logstash or elasticsearch

**URL:** <https://discuss.elastic.co/t/unable-to-configure-filebeat-to-send-to-logstash-or-elasticsearch/248106>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [September 10, 2020, 5:05am UTC](https://discuss.elastic.co/t/unable-to-configure-filebeat-to-send-to-logstash-or-elasticsearch/248106 "2020-09-10T05:05:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![muru1](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@muru1](https://discuss.elastic.co/u/muru1)\
**Post date:** [September 10, 2020, 5:05am UTC](https://discuss.elastic.co/t/unable-to-configure-filebeat-to-send-to-logstash-or-elasticsearch/248106/1 "2020-09-10T05:05:13Z")

</div>

I am trying to setup elk stack with filebeat and unable to send any logs to elasticsearch or logstash using filebeat .  
I am not sure if I am missing something simple - if I use gelf input (ie myapp is shipped to elasticsearch but not nginx2 in the docker-compose mentioned below), by the way the elk stack is running by another docker-compose.yml.  
OS : CentOS VM

filebeat.yml

```auto
filebeat.inputs:
- type: container
  paths: 
    - '/var/lib/docker/containers/*/*.log'

processors:
- add_docker_metadata:
    host: "unix:///var/run/docker.sock"

- decode_json_fields:
    fields: ["message"]
    target: "json"
    overwrite_keys: true

output.elasticsearch:
  hosts: ["hostname:9200"]
  indices:
    - index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
#output.logstash:
# hosts: ["hostname:5044"]

logging.json: true
logging.metrics.enabled: false

```

docker-comopse.yml

```auto
version: '3'

services:
  app:
    image: docker-logs-elk/dummy-app:1.0.0
    container_name: myapp
    build:
      context: dummy-app
      dockerfile: Dockerfile
    volumes:
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
    logging:
      driver: gelf
      options:
        gelf-address: "udp://localhost:12201"

  filebeat:
    image: "docker.elastic.co/beats/filebeat:7.9.0"
    container_name: filebeat
    build:
      context: .
      dockerfile: Dockerfile
    command: filebeat -e -d "publish"
    user: root
    volumes:
      - f_data:/usr/share/filebeat/data:rw
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock
  nginx:
    image: nginx:latest
    container_name: nginx2
    ports:
      - 8081:80
volumes:
# create a persistent volume for Filebeat
  f_data:

```

Please let me know whats missing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2020, 7:05am UTC](https://discuss.elastic.co/t/unable-to-configure-filebeat-to-send-to-logstash-or-elasticsearch/248106/2 "2020-10-08T07:05:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.