@kvch Sorry, I didn't specify: this is with filebeats running inside Kubernetes, with auto-discover enabled and hints on. The example logs I gave a screenshot above was with a pod annotated with:
co.elastic.logs/module: apache2
co.elastic.logs/fileset: access