Filebeat running in docker not creating ECS field ``

I am running a filebeat 7.14.1 in a docker container on a debian host. I am using the modules mysql and system. The filbeat is sending the documents directly to elasticsearch, those are my ingest nodes with the according piplines belonging to the filebeat modules

I excpeted that the ECS field would be created, but it is missing. This lead also into the fact that they are not respected in the kibana security integration on page /app/security/hosts/allHosts? cause the requests there are based on the field presence of

All components are in version 7.14.1.

Configuration can be find here:

Does anyone hava a idea? I can not find a related issue for that.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.