# Filebeat docker container labels do not seems

**URL:** https://discuss.elastic.co/t/filebeat-docker-container-labels-do-not-seems/294408
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [January 14, 2022, 12:01pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-labels-do-not-seems/294408 "2022-01-14T12:01:39Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sahinguler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahinguler/32/99832_2.png) [@sahinguler](https://discuss.elastic.co/u/sahinguler)
#### Post date: [January 14, 2022, 12:01pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-labels-do-not-seems/294408/1 "2022-01-14T12:01:39Z")

</div>

Hi all,

I use filebeat and logstash for store my all datas. My docker setup and log files are in **/home/docker/containers** folder. (not in /var/lib/docker path)

The problem is when i was colleting my logs, the docker fields are not shown. (Such as; **container.labels.com\_docker\_swarm\_service\_name,container.labels.com\_docker\_swarm\_task\_name,container.labels.org\_label-schema\_name,container.labels.org\_label-schema\_schema-version, container.name,container.image.name etc** ).

**How can I see these fieds ?**

My filebeat version is **7.1.1** and also my filebeat.yml as following.

```
  filebeat.autodiscover:
    providers:
      - type: docker
        templates:
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"

filebeat.inputs:
  #------------------------------ Docker input --------------------------------
  - type: docker
    enabled: true
    encoding: "utf-8"
    containers:
      path: "/home/docker/containers"
      ids:
        - "*"
    multiline.pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'
    multiline.negate: true
    multiline.match: after
    exclude_lines: ["^\\s+[\\-`('.|_]"] # drop asciiart lines
    processors:
      - add_host_metadata: ~
      - add_docker_metadata: ~

#=========================== Filebeat inputs ==============================

output.logstash:
  hosts: ["logstash:5044"]
```

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [January 14, 2022, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-labels-do-not-seems/294408/2 "2022-01-14T12:14:28Z")

</div>

Hi!

`docker` input is deprecated so I would suggest you switching to [`container` input](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-container.html) .

C.

---

<div class="post-metadata">

### Author: ![sahinguler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahinguler/32/99832_2.png) [@sahinguler](https://discuss.elastic.co/u/sahinguler)
#### Post date: [January 14, 2022, 1:05pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-labels-do-not-seems/294408/4 "2022-01-14T13:05:07Z")

</div>

Can I see docker container labels in container input ?

In other words, can I add docker metadata with input type container to filebeat ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 11, 2022, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-labels-do-not-seems/294408/5 "2022-02-11T15:05:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.