I'm running docker container without --rm option to make sure this is not because log file is removed by docker. The problem is that not all events are getting sent to elasticsearch: messages are ignored since the point when docker spawns stop event, because autodiscover manager closes harvester too early:
WARN [cfgwarn] docker/input.go:29 EXPERIMENTAL: Docker input is enabled.
INFO log/input.go:111 Configured paths: [/var/lib/docker/containers/f50305f7/*.log]
INFO autodiscover/autodiscover.go:144 Autodiscover starting runner: input [type=docker, ID=1190163555171836425]
INFO input/input.go:87 Starting input of type: docker; ID: 1190163555171836425
INFO log/harvester.go:228 Harvester started for file: /var/lib/docker/containers/f50305f7/f50305f7-json.log
... after 10 seconds ...
INFO autodiscover/autodiscover.go:181 Autodiscover stopping runner: input [type=docker, ID=1190163555171836425]
INFO input/input.go:121 input ticker stopped
INFO input/input.go:138 Stopping Input: 1190163555171836425
INFO log/harvester.go:249 Reader was closed: /var/lib/docker/containers/f50305f7/f50305f7-json.log. Closing.
After inspecting events in my index, I've realized only 530 first messages were indexed out of 568.
Is there any solution?