I'm running filebeat 6.3 as a container on my machine, watching /var/lib/docker/containers//.log (mapped as a volume), and collecting all the logs of all the containers in that machine.
In order to distinguish between the different containers, I add labels to each containers, and make sure they are logged. For example:
This makes the fields pop in the log line, under attrs. What I'm missing, is a way to have a label for the container id, so I can distinguish between different containers of the same kind. Is there a way to add it to the log?
I tried add_docker_metadata but it doesn't seem to work - probably because filebeats is inside a container and not on the host?