Hi!
I'm trying to set up filebeat with docker autodiscovery. But for some reason the event field is missing in documents.
Here the config:
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
filebeat.autodiscover:
providers:
- type: docker
hints.enabled: true
templates:
- config:
- type: container
paths:
- /var/lib/docker/containers/${data.docker.container.id}/*.log
multiline.type: pattern
multiline.pattern: '^[[:space:]]'
multiline.negate: false
multiline.match: after
cloud.id: {{ elasticsearch_cloud_id }}
cloud.auth: {{ elasticsearch_user }}:{{ elasticsearch_password }}
Am I doing anything wrong?