# How to Identify the Container Name When Collecting Container Logs?
**URL:** https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [March 22, 2022, 2:31am UTC](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260 "2022-03-22T02:31:46Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@wajika](https://discuss.elastic.co/u/wajika)
#### Post date: [March 22, 2022, 2:31am UTC](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260/1 "2022-03-22T02:31:46Z")
Currently I use filebeat 7.16.3 and it runs on a kubernetes 1.20 cluster (docker runtime). I use the following configuration to collect container logs, but I found that FB does not recognize the container name corresponding to the collected logs. Is there something wrong with my configuration?
If it is as I expected, FB should be able to automatically identify the log and the corresponding container name.
> Strangely, `data.kubernetes.pod.uid` and `data.kubernetes.container.name` do not appear in the fields
```auto
filebeat.yml: |-
name: masa-iot
tags: ["masa-iot"]
fields:
env: production
filebeat.inputs:
- type: docker
containers.paths:
- /var/log/pods/${data.kubernetes.pod.uid}/${data.kubernetes.container.name}/*.log
containers.ids:
- "*"
message_key: log
keys_under_root: true
symlinks: true
processors:
- add_kubernetes_metadata:
in_cluster: true
scan_frequency: 10s
close_inactive: 1m
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "iot-logs"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.policy_name: "iot-logs"
output.elasticsearch.hosts: ["XXXXX:31111"]
monitoring.enabled: true
monitoring.elasticsearch.hosts: ["XXXXX:31111"]
```
In addition, why can't variables `data.kubernetes.pod.uid` and `data.kubernetes.container.name` be used when `type: containers`
But `type: docker` can
```auto
filebeat.inputs:
- type: container
paths:
- /var/log/pods/${data.kubernetes.pod.uid}/${data.kubernetes.container.name}/*.log
```
---
### Author:  [@wajika](https://discuss.elastic.co/u/wajika)
#### Post date: [March 22, 2022, 2:46am UTC](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260/2 "2022-03-22T02:46:32Z")
I found the parameter to enrich the meta data, the problem is solved.
```auto
processors:
- add_docker_metadata:
host: "unix:///var/run/docker.sock"
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2022, 4:47am UTC](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260/3 "2022-04-19T04:47:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.