Logstash cannot use docker metadata to build a dynamic index

[ktpktr0]

I use filebeat to collect docker logs and add a label when the docker container starts.

- type: docker
  enabled: true
  containers.ids:
    - '*'  
  tail_files: true

The following configuration is made in logstash to build a dynamic index.

filter {
     json {
       source => "message"
   }
}

output {
    elasticsearch {
        hosts => ["192.168.6.155:9200","192.168.6.156:9200","192.168.6.157:9200"]
        ssl => true
        cacert => "/etc/logstash/ssl/root.pem"
        index => "%{[container.labels.service]}-%{+YYYY.MM.dd}"
    }
}

But I failed and got the following index

[leandrojmp (Leandro Pereira)]

You should use [container][labels][service] and not [container.labels.service].

Try to change the index option in your output to this:

index => "%{[container][labels][service]}-%{+YYYY.MM.dd}"

[ktpktr0]

I tried to follow your example, and I got the following results：

%{[container][labels][service]}-2021.04.23

[ktpktr0]

After many tests, I solved the problem, it needs to meet some conditions. Thank you very much for your help