# Docker integration - condition not working

**URL:** <https://discuss.elastic.co/t/docker-integration-condition-not-working/377864>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [May 6, 2025, 3:44pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864 "2025-05-06T15:44:46Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [May 6, 2025, 3:44pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/1 "2025-05-06T15:44:46Z")

</div>

Hi all, thanks for amazing product. I'm trying to set condition for docker logs ingestion and I'm not having success. I always get some kind of error, see below.

Please help me enable conditional logs based on label.

Using condition `arrayContains(${docker.labels}, "filebeat_enable")`  
I get the following error:

```auto
$ elastic-agent inspect
Error: error printing config: error parsing config as hashmap: error unpacking subarray in config for skip key inputs: expected ',' when parsing 'arrayContains(${docker.labels}, "filebeat_enable")' accessing 'inputs.5'

For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.17/fleet-troubleshooting.html

```

Trying condition `arrayContains(${docker.container.labels}, "filebeat_enable")` I get error

```auto
applying new policy: generating component model: rendering inputs failed: condition "arrayContains(${docker.container.labels}, "filebeat_enable")" evaluation failed: arrayContains: first argument must be an array; received map[string]interface {}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 7, 2025, 2:07am UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/2 "2025-05-07T02:07:54Z")

</div>

Hi @dot-mike

Welcome to the community.

It is unclear where you are trying to set that condition...

Elastic Agent Integration? ... Filebeat?

Auto discovery?

What version?

Show us **exactly** where you are trying to set that condition?

Show us what your current configuration is.

Then perhaps someone can help

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [May 7, 2025, 3:19pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/3 "2025-05-07T15:19:48Z")

</div>

Hi and thank you for the reply @stephenb  
I'm trying to set this condition within Agent Policy for Docker integration.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2aa6cec87d495e26ff1740b450af2729cd1e1a11.png)

YAML output of this is (got this from Kibana web-ui running `elastic-agent inspect` fails as noted in OP)

```yaml
  - id: filestream-docker-4eaf178e-9601-4e1d-9a76-1b5265f5ebad
    name: docker-1
    revision: 19
    type: filestream
    use_output: default
    meta:
      package:
        name: docker
        version: 2.14.0
    data_stream:
      namespace: default
    package_policy_id: 4eaf178e-9601-4e1d-9a76-1b5265f5ebad
    streams:
      - id: 'docker-container-logs-${docker.container.name}-${docker.container.id}'
        data_stream:
          dataset: docker.container_logs
          type: logs
          elasticsearch:
            dynamic_dataset: true
            dynamic_namespace: true
        paths:
          - '/var/lib/docker/containers/${docker.container.id}/*-json.log'
        condition: 'arrayContains(${docker.labels}, "filebeat_enable")'
        parsers:
          - container:
              stream: all
              format: docker

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 7, 2025, 6:14pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/4 "2025-05-07T18:14:33Z")

</div>

Perhaps try per the [example](https://www.elastic.co/docs/reference/fleet/dynamic-input-configuration#condition-syntax)

`arrayContains(${docker.labels}, 'filebeat_enable')`

Single quotes into the UI

Also looking at the docker provider

> **[Docker Provider | Elastic Docs](https://www.elastic.co/docs/reference/fleet/docker-provider)**
>
> Provides inventory information from Docker. The available dynamic variables are: To set the container ID dynamically in the configuration, use a variable...

It looks like the provider variable is

`docker.container.labels`

Not

`docker.labels`

So perhaps

`arrayContains(${docker.container.labels}, 'filebeat_enable')`

That is probably the issue.. always need to look at the provider... But the example should be fixed

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [May 9, 2025, 12:13pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/5 "2025-05-09T12:13:48Z")

</div>

Hello,

I tried `arrayContains(${docker.labels}, 'filebeat_enable')` with single quotes and when I execute `elastic-agent inspect` I see

```auto
Error: error printing config: error parsing config as hashmap: error unpacking subarray in config for skip key inputs: expected ',' when parsing 'arrayContains(${docker.labels}, 'filebeat_enable')' accessing 'inputs.5'
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.17/fleet-troubleshooting.html

```

Also tried `arrayContains(${docker.container.labels}, 'filebeat_enable')` and gives this error in logs:

```auto
[elastic_agent][error] applying new policy: generating component model: rendering inputs failed: condition "arrayContains(${docker.container.labels}, 'filebeat_enable')" evaluation failed: arrayContains: first argument must be an array; received map[string]interface {}

```

So I'm not having any luck with the examples.

Environment info:

- Elastic Agent version: 8.17.5
- Docker integration: 2.14.0

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 11, 2025, 1:53am UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/6 "2025-05-11T01:53:06Z")

</div>

Hmm I don't know...

I would take the condition out... collect some logs and look at the labels etc... and see what fields are actually there then comeback and try the condition, that is what I would do.

wonder if you only have 1 label of you should just try a simple string compare.

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [May 16, 2025, 12:23pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/7 "2025-05-16T12:23:35Z")

</div>

I'm not having any luck with this one. any suggestions?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 16, 2025, 2:23pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/8 "2025-05-16T14:23:17Z")

</div>

Did you take the condition out and look at the labels?

And see what's there, What labels exist

There can you show one of the documents that has the label on it?

Need more info if we're going to help

---

<div class="post-metadata">

**Author:** ![gaimes410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaimes410/32/141637_2.png) [@gaimes410](https://discuss.elastic.co/u/gaimes410)\
**Post date:** [May 26, 2025, 12:45pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/9 "2025-05-26T12:45:43Z")

</div>

Hey, have you managed to solve it?

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [May 27, 2025, 12:37pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/11 "2025-05-27T12:37:25Z")

</div>

> [@gaimes410](#):
>
> Hey, have you managed to solve it?

Hi, no sorry. I've not had any free time to look into it.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 27, 2025, 7:12pm UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/12 "2025-05-27T19:12:04Z")

</div>

Hey @dot-mike

I see in another thread that @gaimes410 had the condition working, perhaps they can add some insight...

---

<div class="post-metadata">

**Author:** ![gaimes410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaimes410/32/141637_2.png) [@gaimes410](https://discuss.elastic.co/u/gaimes410)\
**Post date:** [May 28, 2025, 5:34am UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/13 "2025-05-28T05:34:55Z")

</div>

Hey, @dot-mike@stephenb  
I've managed to make it work through the UI using this condition:

`stringContains(${docker.container.name}, "app")`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7c88f3814f5a8cd356badea8c4402acb8873d9f9.png)

looking closely on the error message tho, its the same error that i get when i try to uninstall the agent with the condition.

I've tried to use elastic-agent inspect, got the same error as you

i think there is a problem with the CLI, while the agent itself works fine (i receive the logs correctly)

---

<div class="post-metadata">

**Author:** ![gaimes410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaimes410/32/141637_2.png) [@gaimes410](https://discuss.elastic.co/u/gaimes410)\
**Post date:** [May 28, 2025, 5:49am UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864/14 "2025-05-28T05:49:09Z")

</div>

@dot-mike

> <https://github.com/elastic/elastic-agent/issues/8259>
>
> Hi there!
> Im using elastic stack version 8.18.1 (elastic, kibana, elastic agent)…
> The agents are running on ubuntu 24 servers
> On my ubuntu servers I've configured agent policy that contains docker integration with the following condition:
> \`stringContains(${docker.container.name}, "containerName")\`
> the condition works fine, I'm receiving logs correctly
> When i try to uninstall the agent (using the exact commands and path from the official docs) I'm getting the following error:
> \`
> \[===\] Failed to uninstall agent \[0s\] Error uninstalling. Printing logs
> 2025-05-26T18:32:54.207Z	DEBUG	\[uninstall.state\_migration\]	not attempting to migrate from action store: state store already exists
> 2025-05-26T18:32:54.542Z	DEBUG	\[uninstall.state\_migration\]	not attempting to migrate from action store: state store already exists
> Error: error uninstalling agent: error uninstalling components: error applying dynamic inputs: error unpacking subarray in config for skip key inputs: expected ',' when parsing 'stringContains(${docker.container.name}, "containerName")' accessing 'inputs.8' 
> For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.18/fleet-troubleshooting.html
> \[====\] Uninstall failed \[0s\] Error: failed to uninstall elastic-agent: exit status 1
> For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.18/fleet-troubleshooting.html
> \`
> After modifying the docker integration in the fleet UI and removing the condition, the uninstall process words as expected
> 
> I've opened a discussion in the forums 
> https://discuss.elastic.co/t/docker-integration-unable-to-uninstall-agent/378567/2
> Which seems to approve that this behaviour is a bug
> 
> I've also noticed others in the forums with the same experiencing the same behaviour
> https://discuss.elastic.co/t/docker-integration-condition-not-working/377864
> I've tried to do elastic-agent inspect and got the same error message
> 
> \`
> Error: error printing config: error parsing config as hashmap: error unpacking subarray in config for skip key inputs: expected ',' when parsing 'stringContains(${docker.container.name}, "containerName")' accessing 'inputs.0' 
> For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.18/fleet-troubleshooting.html
> \`
> 
> I've also tried it with elastic stack version 9.0.1 on our test environment with the same outcome
> 
> How to reproduce:
> 1. Install elastic stack (I've done it using docker compose)
> 2. create a policy with docker integration with the condition above (or from the other forum)
> 3. Enroll the agent using the command from fleet ui
> 4. Wait for logs to start arriving (not mandatory, just to see if the condition works)
> 5. Try the command elastic-agent inspect (expected to fail)
> 6. Try the command elastic-agent uninstall (expected to fail)

I've opened an issue on github, feel free to add to it based on your experience