title: Filebeat container does not send logs to Elastic
body: <p>On my local machine running Ubuntu 18.04 via "Windows Subsystem Linux 2" on Windows 10, I am running Elastic 7.3, Kibana 7.3 and Elastic 7.3 docker containers. </p>
  
  <p><strong>Set-up is successful and Filebeat seems to monitor containers correctly. However, Kibana does not show any logs.</strong></p>
  
  <p><strong>Setup</strong></p>
  
  <p>To set-up Elastic and Kibana I use the following commands</p>
  
  <pre><code>
      docker pull docker.elastic.co/elasticsearch/elasticsearch:7.3.1
      docker run --network=lognetwork --name=elasticsearch -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:7.3.1
  
      docker pull docker.elastic.co/kibana/kibana:7.3.1
      docker run --name=kibana --network=lognetwork -e ELASTICSEARCH_HOSTS=http://elasticsearch:9200 -p 5601:5601 docker.elastic.co/kibana/kibana:7.3.1
  
  </code></pre>
  
  <p>After these two commands, the logs from Kibana container show it successfully connects to Elastic:</p>
  
  <pre><code>
      {"type":"log","@timestamp":"2019-09-01T13:22:18Z","tags":["status","plugin:spaces@7.3.1","info"],"pid":6,"state":"green","message":"Status changed from yellow to green - Ready","prevState":"yellow","prevMsg":"Waiting for Elasticsearch"}
  
  </code></pre>
  
  <p>I can also go to Kibana dashboard on <a href="http://localhost:5601" rel="nofollow noreferrer">http://localhost:5601</a> as well as Elastic on <a href="http://localhost:9200" rel="nofollow noreferrer">http://localhost:9200</a> both function properly</p>
  
  <p>I then set up filebeat:</p>
  
  <pre><code>
      docker run --network=lognetwork docker.elastic.co/beats/filebeat:7.3.1 setup -E setup.kibana.host=kibana:5601 -E output.elasticsearch.hosts=["elasticsearch:9200"]
  
  </code></pre>
  
  <p>I can see both Elastic and Kibana container logs and returning 200. The logs on the Filebeat container show:</p>
  
  <pre><code>
      Index setup finished.
      Loading dashboards (Kibana must be running and reachable)
      Loaded dashboards
      Loaded machine learning job configurations
      Loaded Ingest pipelines
  
  </code></pre>
  
  <p>Finally, I pull the default config from Elastic site, launch Filebeat and attach to the container</p>
  
  <pre><code>
      curl -L -O https://raw.githubusercontent.com/elastic/beats/7.3/deploy/docker/filebeat.docker.yml
  
      docker run -d --network=lognetwork  --name=filebeat   --user=root   --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro"   --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro"   --volume="/var/run/docker.sock:/var/run/docker.sock:ro"   docker.elastic.co/beats/filebeat:7.3.1 filebeat -e -strict.perms=false   -E output.elasticsearch.hosts=["elasticsearch:9200"]
      docker attach filebeat
  
  </code></pre>
  
  <p>I can see Filebeat sending monitoring pulse but when it does, elastic logs do not show anything new.</p>
  
  <p>To test, I launch Docker "hello-world" which generates several lines of logs</p>
  
  <pre><code>
      docker run hello-world
  
  </code></pre>
  
  <p>Filebeat shows the following log</p>
  
  <pre><code>
      2019-09-01T13:30:40.624Z        INFO    log/input.go:148        Configured paths: [/var/lib/docker/containers/460cc8c215ff69ecf28685c9cf89c0e56d0b3e4f680b8bf29beb5b570ebb7a14/*-json.log]
      2019-09-01T13:30:40.624Z        INFO    input/input.go:114      Starting input of type: container; ID: 16402101064670842079
  
  </code></pre>
  
  <p>I then go to <a href="http://localhost:5601" rel="nofollow noreferrer">http://localhost:5601</a></p>
  
  <p><strong>Results</strong>:<br>
  Kibana shows no logs. Clicking for "check for new data" does not show anything either.</p>
  
  <p>The folder /var/lib/docker/containers is also empty. The path returned by filebeat log (/var/lib/docker/containers/460cc8c215ff69ecf28685c9cf89c0e56d0b3e4f680b8bf29beb5b570ebb7a14/) does not seem to exist.</p>
  
  <p><strong>Expected</strong>:<br>
  - Kibana to show the "hello world" docker container logs<br>
  - To see a log file under /var/lib/docker/containers  </p>
  
  <p>What am I missing?</p>
  
  <p>Thank you,<br>
  Olivier</p>