When running Filebeat as a docker container and using the System module in the filebeat.yml it requires access to the host's file system for reading from /var/logs/ (easy enough) but once the System module pulls the logs you must also use the processor "add_process_metadata" which the (Filebeat) container doesn't have access nor a configuration to the host's /proc (process ids) to get the syslog process.* details. Is this a known issue?
(more background) Metricbeat has overcome this issue with the "add_process_metadata" via use of the --system.hostfs configuration.