3

I have a running docker image that produces some logs, putting them in the default location /var/lib/docker/containers/CONTAINER_ID, and another docker image with Filebeat that should read from the first image.

I set the Logstash configuration in the following way:

filebeat.inputs:
  - type: docker
    containers.ids:
      - 'CONTAINER_ID'

Since I'm on Mac OS X (10.13.6) the logs are placed inside a virtual machine, and not in the filesystem of my computer. For this reason Filebeat doesn't read anything.

The strange things, in my opinion, is that the logs of Filebeat don't show any error message, but rather it says that it's reading from the correct location.

The log file is not empty, but Filebeat doesn't read anything at all. Any suggestion on what to do to solve this?

Thank you

Nicolò Pomini
  • 186
  • 2
  • 6
  • Is the reading container probably not able to access the file, but is happy with only finding it? So there is an error, but it is omitted/hidden? – Markus Deibel Mar 29 '19 at 16:53
  • @MarkusDeibel yes, no errors are displayed on the logs of the reading container, neither warning messages. – Nicolò Pomini Mar 30 '19 at 17:43

0 Answers0