Metricbeat fails to index docker metadata

Elastic Stack Beats
1

Hi,

I have deployed Metricbeat and Auditbeat (7.1.0-SNAPSHOT) as a daemonSet on a k8s cluster, the container Metricbeat module is reporting the info of an event related to Auditbeat daemonSet and it fails to store the data on Elasticsearch with a mapping error

"org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [docker.container.ip_addresses] of type [ip] in document with id '4ARYWWkBTidYNB1MYom3'","at org.elasticsearch.index.mapper.FieldMapper.parse(FieldMapper.java:280) ~[elasticsearch-7.1.0-SNAPSHOT.jar:7.1.0-SNAPSHOT]","at

This is the JSON message, the IP is empty so it is not an IP ("ip_addresses": [""],), as a workaround I have disabled the containers module on the docker.yml file.

{
  [metricbeat - 7.1 .0][_doc][4 ARYWWkBTidYNB1MYom3], source[{
    "@timestamp": "2019-03-07T18:08:00.214Z",
    "docker": {
      "container": {
        "labels": {
          "io_kubernetes_docker_type": "podsandbox",
          "annotation_kubernetes_io/config_seen": "2019-03-07T18:05:52.183452515Z",
          "annotation_kubernetes_io/config_source": "api",
          "io_kubernetes_pod_namespace": "kube-system",
          "pod-template-generation": "1",
          "io_kubernetes_container_name": "POD",
          "io_kubernetes_pod_name": "auditbeat-w7j9j",
          "k8s-app": "auditbeat",
          "controller-revision-hash": "1545459614",
          "io_kubernetes_pod_uid": "a5145dea-4103-11e9-b1d6-42010a8401a4"
        },
        "image": "k8s.gcr.io/pause-amd64:3.1",
        "status": "Up 2 minutes",
        "id": "06e88f74f9455c64af63e503dc85be6ad25c1b8d728b8d230049dee53bc6ff6d",
        "name": "k8s_POD_auditbeat-w7j9j_kube-system_a5145dea-4103-11e9-b1d6-42010a8401a4_0",
        "ip_addresses": [""],
        "size": {
          "rw": 0,
          "root_fs": 0
        },
        "created": "2019-03-07T18:05:52.000Z",
        "command": "/pause"
      }
    },
    "event": {
      "duration": 15917699,
      "dataset": "docker.container",
      "module": "docker"
    },
    "host": {
      "hostname": "gke-XXXXXXXXXX-pool-1-c6a5cd7f-ggzj",
      "architecture": "x86_64",
      "os": {
        "platform": "centos",
        "version": "7 (Core)",
        "family": "redhat",
        "name": "CentOS Linux",
        "kernel": "4.14.65+",
        "codename": "Core"
      },
      "containerized": true,
      "name": "gke-XXXXXXXXXX-pool-1-c6a5cd7f-ggzj"
    },
    "ecs": {
      "version": "1.0.0-beta2"
    },
    "agent": {
      "id": "70b22ecd-18ee-43ff-9bc5-a53433d68d11",
      "version": "7.1.0",
      "type": "metricbeat",
      "ephemeral_id": "81b25b3a-55ac-44cd-b77c-b59872c3dea8",
      "hostname": "gke-XXXXXXXXXX-pool-1-c6a5cd7f-ggzj"
    },
    "cloud": {
      "machine": {
        "type": "projects/XXXXXXXXXX/machineTypes/n1-standard-2"
      },
      "availability_zone": "projects/XXXXXXXXXX/zones/europe-west1-c",
      "instance": {
        "id": "7177843840848088616",
        "name": "gke-XXXXXXXXXX-pool-1-c6a5cd7f-ggzj"
      },
      "project": {
        "id": "XXXXXXXXXX"
      },
      "provider": "gce"
    },
    "metricset": {
      "name": "container"
    },
    "service": {
      "address": "/var/run/docker.sock",
      "type": "docker"
    }
  }]
}
2

It is resolved