# Filebeat: add\_docker\_metadata doesn't always work

**URL:** <https://discuss.elastic.co/t/filebeat-add-docker-metadata-doesnt-always-work/378339>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [May 20, 2025, 11:49am UTC](https://discuss.elastic.co/t/filebeat-add-docker-metadata-doesnt-always-work/378339 "2025-05-20T11:49:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![frans-wtax](https://avatars.discourse-cdn.com/v4/letter/f/ce73a5/32.png) [@frans-wtax](https://discuss.elastic.co/u/frans-wtax)\
**Post date:** [May 20, 2025, 11:49am UTC](https://discuss.elastic.co/t/filebeat-add-docker-metadata-doesnt-always-work/378339/1 "2025-05-20T11:49:12Z")

</div>

I have filebeat running directly on my OS and it's ingesting Docker log files from `/var/log/docker/containers/*/*-json.log`:

```auto
filebeat:
  # List of inputs.
  inputs:
    - type: filestream
      id: container
      paths:
        - "/var/lib/docker/containers/*/*-json.log"
      parsers:
        - ndjson:
            target: ""
            message_key: log
      fields_under_root: true
      processors:
        - add_docker_metadata:
            match_source: true

```

Most of the time this works fine, and the container fields are added to the event, including `container.id`, `container.id_short`, and `container.name`.

However, in some cases, and I haven't been able to narrow this down yet, the `container.name` field is not added.

I had this problem, and when I restarted filebeat, it went away, i.e. `container.name` was added to events again. This would almost point to a caching issue or something like that. `add_docker_metadata.cleanup_timeout` is left at the default, so that doesn't seem to be the issue.

Any ideas? Any people with similar experiences?

Thanks,  
Frans