can not set logging to file when use docker

[feblilac]

For confirmed bugs, please report:

• Beat Version: filebeat 6.2.3
• Operating System: centos7
• Docker Version:18.04.0-ce
• Steps to Reproduce:

set the config file: /xxxx/filebeat/config/filebeat.yml like this: logging.level: info logging.to_files: true logging.files: path: /usr/share/filebeat/logs name: filebeat keepfiles: 7 permissions: 0664

and then run docker container: docker run -d --restart=always --name=filebeat -v /xxxx/filebeat/logs/:/usr/share/filebeat/logs -v /xxxx/filebeat/config/filebeat.yml:/usr/share/filebeat/filebeat.yml docker.elastic.co/beats/filebeat:6.2.3

but there is no log file in "/xxxx/filebeat/logs/" on VM,also no file in "/usr/share/filebeat/logs" in the container.

[jarpy]

Hi,

Please format your config YAML with triple-ticks ( ``` ) so that it's valid and readable.

Thanks.

[feblilac]

Hi, The config YAML is like this:

filebeat.prospectors:
- type: log
  # Change to true to enable this prospector configuration.
  enabled: true
  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /xx/xx/xx/xx/*
  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  exclude_lines: ['INFO']
  # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
  multiline.pattern: ^[0-2][0-2][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-2][0-9]:[0-5][0-9]:[0-5][0-9].[0-9][0-9][0-9]
  # Defines if the pattern set under pattern should be negated or not. Default is false.
  multiline.negate: true
  # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
  # that was (not) matched before or after or as long as a pattern is not matched based on negate.
  # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
  multiline.match: after
#============================= Filebeat modules ===============================
filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml
  # Set to true to enable config reloading
  reload.enabled: false
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["x.x.x.x:5044","x.x.x.x:5044"]
  loadbalance: true
  worker: 2
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging:
  level: warning
  to_files: true
  files:
    path: /usr/share/filebeat/logs
    name: filebeat.log
    keepfiles: 7

[andrewkroh]

By default the container is started with -e which causes all logging to go to stderr so that things like docker logs work as expected.

https://github.com/elastic/beats-docker/blob/2451b21d42d6a009454ea1edeab9bd8335cd9713/templates/Dockerfile.j2#L62

To override this behavior you can pass in -e=false as an argument.

[feblilac]

Thanks! The problem has been solved.