# Why only elasticsearch container starts and kibana and filebeat containers are not getting up?

**URL:** <https://discuss.elastic.co/t/why-only-elasticsearch-container-starts-and-kibana-and-filebeat-containers-are-not-getting-up/298040>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [February 23, 2022, 1:19pm UTC](https://discuss.elastic.co/t/why-only-elasticsearch-container-starts-and-kibana-and-filebeat-containers-are-not-getting-up/298040 "2022-02-23T13:19:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mahesh\_Abnave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahesh_abnave/32/102143_2.png) [@Mahesh\_Abnave](https://discuss.elastic.co/u/Mahesh_Abnave)\
**Post date:** [February 23, 2022, 1:19pm UTC](https://discuss.elastic.co/t/why-only-elasticsearch-container-starts-and-kibana-and-filebeat-containers-are-not-getting-up/298040/1 "2022-02-23T13:19:41Z")

</div>

I have an application running on six services (or containers) running on an existing docker network. I have deployed them on my local machine using `docker stack deploy` command. I wanted to create another set of containers of Elasticsearch, kibana and filebeat to monitor the existing docker services services. I went through some online tutorials and figured out below docker compose configuration:

**docker-compose.yml**

```
version: "3.8"

networks: 
  existing_network: 
    external: true

services:
  elasticsearch:
    image: 'docker.elastic.co/elasticsearch/elasticsearch:8.0.0'
    container_name: elasticsearch
    ports:
      - '9200:9200'
    networks:
      - existing_network

  kibana:
    image: 'docker.elastic.co/kibana/kibana:8.0.0' 
    container_name: kibana
    ports:
      - '5601:5601'
    healthcheck:
      test: ["CMD", "curl", "-f", "kibana:5601"]
      interval: 10s
      timeout: 10s
      retries: 5
    depends_on:
      - elasticsearch
    environment:
      - 'ELASTICSEARCH_HOSTS=http://elasticsearch:9200'
    networks:
      - existing_network

  filebeat:
    image: 'docker.elastic.co/beats/filebeat:8.0.0' 
    user: oem
    container_name: filebeat
    volumes:
      - /home/oem/elk/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on: 
      - elasticsearch
      - kibana
    networks:
      - existing_network

```

This is the filebeat configuration I tried:

**filebeat.docker.yml**

```
filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

processors:
  - add_cloud_metadata: ~
  - add_docker_metadata: ~

output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'

```

After running

```
> docker stack deploy -c docker-compose.yml elk
Creating service elk_elasticsearch
Creating service elk_kibana
Creating service elk_filebeat

```

I tried to check kibana's logs:

```
> docker service logs -f elk_kibana
elk_kibana.1.wvvxup2ltt9o@Mahesh-Ubuntu | i Kibana has not been configured.
elk_kibana.1.wvvxup2ltt9o@Mahesh-Ubuntu | 
elk_kibana.1.wvvxup2ltt9o@Mahesh-Ubuntu | Go to http://0.0.0.0:5601/?code=537558 to get started.
elk_kibana.1.wvvxup2ltt9o@Mahesh-Ubuntu | 
elk_kibana.1.wvvxup2ltt9o@Mahesh-Ubuntu | 
elk_kibana.1.wvvxup2ltt9o@Mahesh-Ubuntu | [2022-02-17T00:12:20.458+00:00][INFO][plugins-system.preboot] Stopping all plugins.
elk_kibana.1.6i1ucgg2hzi7@Mahesh-Ubuntu | [2022-02-17T00:13:41.748+00:00][INFO][plugins-service] Plugin "metricsEntities" is disabled.
elk_kibana.1.6i1ucgg2hzi7@Mahesh-Ubuntu | [2022-02-17T00:13:41.895+00:00][INFO][http.server.Preboot] http server running at http://0.0.0.0:5601
elk_kibana.1.6i1ucgg2hzi7@Mahesh-Ubuntu | [2022-02-17T00:13:41.951+00:00][INFO][plugins-system.preboot] Setting up [1] plugins: [interactiveSetup]
elk_kibana.1.6i1ucgg2hzi7@Mahesh-Ubuntu | [2022-02-17T00:13:41.953+00:00][INFO][preboot] "interactiveSetup" plugin is holding setup: Validating Elasticsearch connection configuration…
elk_kibana.1.6i1ucgg2hzi7@Mahesh-Ubuntu | [2022-02-17T00:13:41.997+00:00][INFO][root] Holding setup until preboot stage is completed.

```

From the above logs, I realized that Kibana is not getting configured and is exiting. So, I was not able to open `http://0.0.0.0:5601` in the browser.

I tried to check filebeat logs. But following command outputs nothing:

```
$docker service logs -f elk_filebeat

```

This no-logs behavior seem to be the bug: [1](https://stackoverflow.com/questions/68386360/where-to-check-for-docker-service-logs), [2](https://stackoverflow.com/questions/58830108/docker-service-freezes-with-no-logs) and [3](https://github.com/moby/moby/issues/41733).

So I tried to add the following to `filebeat.docker.yml` (though I didn't know if this is the correct configuration):

```
setup.kibana:
   host: 'kibana:5601'

```

But I got the same behavior: only Elasticsearch was getting up and rest were down.  
Next, I tried to add following to `filebeat.docker.yml`:

```
environment:
  output.elasticsearch.hosts: '["elasticsearch:9200"]'
  setup.kibana.host: kibana:5601

```

Still the exact same behavior.

**Q1.** It seems that I am missing something basic here. How can I make all three Elasticsearch, kibana and filebeat up and running?  
**Q2.** Also can someone point me to any tutorial(s) (possibly official ones) which discuss monitoring existing applications and infrastructure deployed on the docker containers?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2022, 3:19pm UTC](https://discuss.elastic.co/t/why-only-elasticsearch-container-starts-and-kibana-and-filebeat-containers-are-not-getting-up/298040/2 "2022-03-23T15:19:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.