# Writing the Filebeat Registry

**URL:** <https://discuss.elastic.co/t/writing-the-filebeat-registry/144289>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 14, 2018, 7:17am UTC](https://discuss.elastic.co/t/writing-the-filebeat-registry/144289 "2018-08-14T07:17:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christian\_Wohrle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_wohrle/32/49777_2.png) [@Christian\_Wohrle](https://discuss.elastic.co/u/Christian_Wohrle)\
**Post date:** [August 14, 2018, 7:17am UTC](https://discuss.elastic.co/t/writing-the-filebeat-registry/144289/1 "2018-08-14T07:17:41Z")

</div>

Hi,

I´m using filebeat 6.3.2 in a docker container.

Shipping Logs works, and it looks the registry /usr/share/filebeat/data/registry is updated (timestamp increases, length changes).

But I´m getting these errors every minute or so.

> ERROR registrar/registrar.go:346 Writing of registry returned error: rename /usr/share/filebeat/data/registry.new /usr/share/filebeat/data/registry: no such file or directory. Continuing...

I can get rid of this error if I explicitly set the filename via

> filebeat.registry\_file: ${path.data}/myregistry

And the error only occurs if I mount a host volume to /usr/share/filebeat/data/, but I have checked that the directory /usr/share/filebeat/data/ is writable for the docker container and the files as well (and the container runs with user root).

Any idea what provokes the error above?

**docker run:**

```
#!/bin/bash
set -x
docker rm -v fb
docker run \
 --env "TZ=Europe/Berlin" \
 --hostname dwpmicrappe04 \
 --log-driver json-file \
 --log-opt max-size=10g \
 --log-opt max-file=2 \
 -v /var/lib/docker:/var/lib/docker \
 -v /var/run/docker.sock:/var/run/docker.sock \
 -v $(pwd)/filebeat.yml:/usr/share/filebeat/filebeat.yml \
 -v /appdata/container/filebeat/data/:/usr/share/filebeat/data/ \
  --name fb \
  --user 0 \
  -l co.elastic.logs/disable=true \
  via/docker.elastic.co/beats/filebeat:6.2.4

```

**filebeat config**

```
---
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      templates:
        - condition:
            contains.docker.container.image: logprod
          config:
            - type: log
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              json.keys_under_root: true
              fields:
                level: info
                labels: ${data.docker.container.labels.label1}
name: dwpmicrappe04
fields:
  app: filebeat
  stage: e
  customer: dwpbank
logging.level: info
fields_under_root: true
processors:
- decode_json_fields:
    fields: ["log"]
- rename:
    fields:
      - from: "log"
        to: "fredfroehn"
- drop_fields:
    fields: ["input", "time", "host"]
filebeat.registry_file: ${path.data}/myregistry
output.console:
  enabled: false
  pretty: true
output.redis:
  enabled: true
  hosts: ["2.104.19.25:6379", "2.104.19.26:6379", "2.104.19.27:6379", "2.104.19.28:6379"]
  key: logstash
  ssl.enabled: true
  ssl.verification_mode: none
logging.to_files: false

```

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 14, 2018, 7:27am UTC](https://discuss.elastic.co/t/writing-the-filebeat-registry/144289/2 "2018-08-14T07:27:51Z")

</div>

I have seen a similar issue before on our CI, but I could not reproduce it. [https://github.com/elastic/beats/issues/7687](https://github.com/elastic/beats/issues/7687)  
I am not sure yet if the root cause is the same, so please open a separate issue on Github. At least this problem can be reproduced consistently. [https://github.com/elastic/beats/issues/new](https://github.com/elastic/beats/issues/new)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2018, 7:27am UTC](https://discuss.elastic.co/t/writing-the-filebeat-registry/144289/3 "2018-09-11T07:27:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.