Sidecar not showing any messages in the graylog web_interface

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
My graylog server is running within container so is my sidecar service . I am able to see the sidecar instance on the graylog web interface but not able to see any messages in sidecar

2. Describe your environment:

3. What steps have you already taken to try and solve the problem?

4. How can the community help?
please suggest what changes to be made to see the logs on UI.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Looks like your path is off a little. If you want all the files in that directory you need to use the * as in /home/logs/*

Here is a generic one that grabs all files ending in log

# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

- input_type: log
    - /var/log/*.log
  type: log
   - ${user.BeatsInput}
  data: /var/cache/graylog-sidecar/filebeat/data
  logs: /var/log/graylog-sidecar


Adding on to @tmacgbay statement.

Did you insure that port “5044” is opened?

Also I noticed you using port 8007 for Graylog’s URL API ?


In this section

Found here

If I run my sidecar container with the above suggestion I get followign erros in my container logs

These is how i set the path

Any idea why am I getting this issue because when i working on host with these services it was working fine but with containers i am facing this issue

I have open the port 5044 on both services of mine sidecar and graylog as well below screen shots are Dockefile for sidecar and docker-compose.yml file for graylog service
Sidecar docker image

graylog docker-compose.yml file

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.