I have configured FileBeat on the ELK stack using docker.
On the host machine, elasticsearch, logstash, kibana, and filebeat create images and run containers through docker-compose settings.
HostMachine’s /sample_logs path is mounted on filebeat’s /var/log/server path, and filebeat collects files in the /var/log/server path and delivers them to logstash.
[Problem that occurred]
When filebeat is run as Docker, the files in /sample_logs are normally reflected in /var/log/server in the filebeat container and sent to logstash.
However, even if the files in sample_logs are modified on the host machine afterward, the files in the filebeat container are not changed.
The confirmed phenomenon is as follows.
In Host Machine, echo ‘blar blar…’ >> app.log or chmod 755 app.log is reflected normally when directly modifying the file.
The above phenomenon occurs for files being modified by applications on the Host Machine. (ex: Log file generated by the application when the SpringBoot application is executed with IntelliJ)
The configuration file is placed in the path below.
I need help, Thank you.