Filebeat: add_docker_metadata doesn't always work

Elastic Stack Beats
,
1

I have filebeat running directly on my OS and it's ingesting Docker log files from /var/log/docker/containers/*/*-json.log:

filebeat:
  # List of inputs.
  inputs:
    - type: filestream
      id: container
      paths:
        - "/var/lib/docker/containers/*/*-json.log"
      parsers:
        - ndjson:
            target: ""
            message_key: log
      fields_under_root: true
      processors:
        - add_docker_metadata:
            match_source: true

Most of the time this works fine, and the container fields are added to the event, including container.id, container.id_short, and container.name.

However, in some cases, and I haven't been able to narrow this down yet, the container.name field is not added.

I had this problem, and when I restarted filebeat, it went away, i.e. container.name was added to events again. This would almost point to a caching issue or something like that. add_docker_metadata.cleanup_timeout is left at the default, so that doesn't seem to be the issue.

Any ideas? Any people with similar experiences?

Thanks,
Frans