# Incorrect Journalbeat container output fields for Docker journald messages
**URL:** https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017
**Category:** Beats
**Tags:** journalbeat
**Created:** [January 28, 2019, 3:10pm UTC](https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017 "2019-01-28T15:10:00Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@SpComb](https://discuss.elastic.co/u/SpComb)
#### Post date: [January 28, 2019, 3:10pm UTC](https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017/1 "2019-01-28T15:10:00Z")
These two `journalbeat` translated fields for the Docker `--log-driver=journald` messages seem wrong:
`conatiner.id_truncated` is typo'd (also in git master): [https://github.com/elastic/beats/blob/v6.5.4/journalbeat/reader/fields.go#L83](https://github.com/elastic/beats/blob/v6.5.4/journalbeat/reader/fields.go#L83)
`container.image.tag` from `CONTAINER_TAG` seems wrong per the ECS spec: it's not the tag part of the container image, it's whatever gets configured via `docker run --log-opt tag=...`. It defaults to the truncated container ID, although you could configure it to be e.g. `--log-opt 'tag={{.ImageName}}'` - but even that would give you the full image reference (`REPO/IMAGE:TAG`), not just the tag.
For my setup, I've configured logstash with `mutate { replace => { "[container][image][tag]" => "[container][tag]" } }` as a workaround, because most of my filter rules are based on the `CONTAINER_TAG`, and it doesn't make any sense to mix those up with the actual `[container][image][tag]` that might be gathered by something like the Docker metadata processor.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [January 28, 2019, 3:35pm UTC](https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017/2 "2019-01-28T15:35:29Z")
Do you mind opening an issue on Github? [https://github.com/elastic/beats/issues/new](https://github.com/elastic/beats/issues/new)
---
### Author:  [@SpComb](https://discuss.elastic.co/u/SpComb)
#### Post date: [February 4, 2019, 12:07pm UTC](https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017/3 "2019-02-04T12:07:44Z")
Reported as two separate issues:
- [https://github.com/elastic/beats/issues/10519](https://github.com/elastic/beats/issues/10519)
- [https://github.com/elastic/beats/issues/10520](https://github.com/elastic/beats/issues/10520)
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [February 4, 2019, 12:22pm UTC](https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017/4 "2019-02-04T12:22:52Z")
Thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 6:52am UTC](https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017/5 "2022-11-04T06:52:46Z")