# "ERR Dropping event: key=message: key not found" using "add\_docker\_metadata"

**URL:** <https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 27, 2018, 8:06am UTC](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784 "2018-04-27T08:06:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mimmus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mimmus/32/34273_2.png) [@mimmus](https://discuss.elastic.co/u/mimmus)\
**Post date:** [April 27, 2018, 8:06am UTC](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784/1 "2018-04-27T08:06:46Z")

</div>

Hi,  
trying this:  
[https://www.elastic.co/blog/enrich-docker-logs-with-filebeat](https://www.elastic.co/blog/enrich-docker-logs-with-filebeat)  
(but with Kafka output plugin)  
I get A LOT of:  
client.go:108: ERR Dropping event: key=message: key not found  
error messages.

No idea where look for.

Any help?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 27, 2018, 11:39am UTC](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784/2 "2018-04-27T11:39:44Z")

</div>

Could you please share your configuration and debug logs? Please format them using `</>`.

---

<div class="post-metadata">

**Author:** ![mimmus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mimmus/32/34273_2.png) [@mimmus](https://discuss.elastic.co/u/mimmus)\
**Post date:** [April 27, 2018, 12:07pm UTC](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784/3 "2018-04-27T12:07:09Z")

</div>

I'm using Filebeat in a Docker container (running on CoreOS Linux).  
This is filebeat.yml:  
[https://pastebin.com/WCKqpZjF](https://pastebin.com/WCKqpZjF)  
(sorry for external link)

Any help to generate debug logs using Filebeat in a container?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 27, 2018, 12:48pm UTC](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784/4 "2018-04-27T12:48:07Z")

</div>

Start filebeat in the foreground and enable debug logging:

```auto
./filebeat -e -d "*"

```

---

<div class="post-metadata">

**Author:** ![mimmus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mimmus/32/34273_2.png) [@mimmus](https://discuss.elastic.co/u/mimmus)\
**Post date:** [April 27, 2018, 1:24pm UTC](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784/5 "2018-04-27T13:24:29Z")

</div>

Probably due to:  
`codec.format:`  
`string: 'beat=%{[beat]} message=%{[message]}'`  
in output.kafka.

I apologize for attributing it to add\_docker\_metadata and thanks for lesson about debugging!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2018, 1:33pm UTC](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784/6 "2018-05-25T13:33:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.