# Filebeat container fields mix info from several containers

**URL:** <https://discuss.elastic.co/t/filebeat-container-fields-mix-info-from-several-containers/360358>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [May 28, 2024, 9:03am UTC](https://discuss.elastic.co/t/filebeat-container-fields-mix-info-from-several-containers/360358 "2024-05-28T09:03:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ayrm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayrm/32/122198_2.png) [@ayrm](https://discuss.elastic.co/u/ayrm)\
**Post date:** [May 28, 2024, 9:03am UTC](https://discuss.elastic.co/t/filebeat-container-fields-mix-info-from-several-containers/360358/1 "2024-05-28T09:03:54Z")

</div>

I'm sending logs to Graylog using filebeat on linux with the following conf:

```auto
filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - condition:
            regexp:
              docker.container.name: ^.+$
          config:
            - type: container
              paths:
                - /srv/docker/containers/*/*
              exclude_lines:
                - ^\s+[\-`('.|_]
              encoding: plain
              scan_frequency: 10s
              tail_files: true
              symlinks: true
              multiline.type: pattern
              multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
              multiline.negate: true
              multiline.match: after
              json.message_key: log
              json.keys_under_root: true

```

There are several containers running on the server running the log collector. I want to collect logs for all the containers and in fact the conf above is doing the job BUT the information of filebeat container fields is mismatching the actual information.

I get the correct filebeat\_log\_file\_path and the correct message but the filebeat container fields does not match the container from where I get the message.

Any hint, help?