Filebeat with container type input uses image digest instead of tag (or both) when sending the logs

Elastic Stack Beats
1

Hi!

We are facing an issue with pod logs collected from k8s via Filebeat.
The field "container.image.name" only contains the digest, the tag is missing.
Not sure wether its a bug, or inteded feature, but we would like to have both available to search. People dont know from the top of their head the digest, but they do know the tag :slight_smile:
We have a standard filebeat configuration (with and without logstash, dependent on environments), both are affected.

Debug from logstash shows it doesnt receive the tag:
"runtime" => "cri-o",
"image" => {
"name" => "registry/asd/debian@sha256:55[..]"

Of course in the pod config we have the whole image (with tag and digest).
Currently developers/testers have to check in the dashboard the image digest, then search for it in kibana, adding a long extra step for debugs.

Any idea how we can include the full image name?

2

It might be something irrelevant to filebeat.
However, to help us out, can someone describe how filebeat gets the image name to point us in a direction?