Skip to content
A docker image using the Docker API to collect and ship containers logs to Logstash
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
Dockerfile Reformat Dockerfile + update docker-compose file with bargenson/fileb… Feb 24, 2016
docker-compose.yml Reformat Dockerfile + update docker-compose file with bargenson/fileb… Feb 24, 2016 Image changed to alpine. Feb 24, 2016
filebeat.yml Image changed to alpine. Feb 24, 2016

What is Filebeat?

Filebeat is a lightweight, open source shipper for log file data. As the next-generation Logstash Forwarder, Filebeat tails logs and quickly sends this information to Logstash for further parsing and enrichment.

alt text

Why this image?

This image uses the Docker API to collect the logs of all the running containers on the same machine and ship them to a Logstash. No need to install Filebeat manually on your host or inside your images. Just use this image to create a container that's going to handle everything for you :-)

How to use this image

Start Filebeat as follows:

$ docker run -d 
   -v /var/run/docker.sock:/tmp/docker.sock 
   -e -e LOGSTASH_PORT=5044 -e SHIPPER_NAME=$(hostname) 

Three environment variables are needed:

  • LOGSTASH_HOST: to specify on which server runs your Logstash
  • LOGSTASH_PORT: to specify on which port listens your Logstash for beats inputs
  • SHIPPER_NAME: to specify the Filebeat shipper name (deafult: the container ID)

The docker-compose service definition should look as follows:

  image: bargenson/filebeat
  restart: unless-stopped
   - /var/run/docker.sock:/tmp/docker.sock
   - SHIPPER_NAME=aWonderfulName

Logstash configuration:

Configure the Beats input plugin as follows:

input {
  beats {
    port => 5044

In order to have a containerName field and a cleaned message field, you have to declare the following filter:

filter {

  if [type] == "filebeat-docker-logs" {

    grok {
      match => { 
        "message" => "\[%{WORD:containerName}\] %{GREEDYDATA:message_remainder}"

    mutate {
      replace => { "message" => "%{message_remainder}" }
    mutate {
      remove_field => [ "message_remainder" ]



User Feedback


If you have any problems with or questions about this image, please contact me through a GitHub issue.


You are invited to the GitHub repo to contribute new features, fixes, or updates, large or small.

You can’t perform that action at this time.