Missing container fields

Elastic Stack Beats
1

I'm running Filebeat 7.3 on Kubernetes with this configuration:

    processors:
    - add_cloud_metadata:
    - add_kubernetes_metadata:
        in_cluster: true
    filebeat.autodiscover:
      providers:
      - type: kubernetes
        templates:
        - config:
          - type: container
            paths:
            - /var/lib/docker/containers/${data.kubernetes.container.id}/*.log
            json.keys_under_root: true
            json.add_error_key: false
            json.ignore_decoding_error: true

For some reason, the container.* fields are missing. The same thing happens for Metricbeat as well. Other ECS fields are present, and the cloud.* and kubernetes.* fields are present too.

image
image.png445×844 59.7 KB

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.