With Docker version 18.09.5, build e8ff056 and filebeat:7.1.1 (by elasticsearch) when I type:
$ docker logs filebeat > filebeat.log
I see the logs but the filebeat.log is empty.
If I try:
$ docker logs logstash > logstash.log
I don't see the log to console but the file il full with the logs lines.
The used OS is: Ubuntu 19.04
The > redirects STDOUT, but you can also have STDERR output from containers. To redirect that, you can use:
docker logs filebeat > filebeat.log 2> filebeat.err
or send both to the same file:
docker logs filebeat > filebeat.log 2>&1
You should run the container with the -t flag which will allocate a pseudo-tty for the container. Example:
docker run -td --rm --name test store/elastic/filebeat:7.1.1
docker logs test > test.txt
This will store the output to the file. When running without the -t flag it will simply dump the logs in your terminal