Logstash cannot use docker metadata to build a dynamic index

Elastic Stack Logstash
1

I use filebeat to collect docker logs and add a label when the docker container starts.
1

- type: docker
  enabled: true
  containers.ids:
    - '*'  
  tail_files: true

The following configuration is made in logstash to build a dynamic index.

filter {
     json {
       source => "message"
   }
}

output {
    elasticsearch {
        hosts => ["192.168.6.155:9200","192.168.6.156:9200","192.168.6.157:9200"]
        ssl => true
        cacert => "/etc/logstash/ssl/root.pem"
        index => "%{[container.labels.service]}-%{+YYYY.MM.dd}"
    }
}

But I failed and got the following index

2

2

You should use [container][labels][service] and not [container.labels.service].

Try to change the index option in your output to this:

index => "%{[container][labels][service]}-%{+YYYY.MM.dd}"
3

I tried to follow your example, and I got the following results：

%{[container][labels][service]}-2021.04.23

4

After many tests, I solved the problem, it needs to meet some conditions. Thank you very much for your help