filebeat.inputs: - type: filestream id: docker-containers enabled: true paths: - /var/lib/docker/containers/*/*.log parsers: - container: stream: all format: docker processors: - add_docker_metadata: host: unix:///var/run/docker.sock - add_host_metadata: ~ output.logstash: hosts: ["logstash:5044"] logging.level: info