Missing event field from filebeat via docker autodiscovery

Hi!

I'm trying to set up filebeat with docker autodiscovery. But for some reason the event field is missing in documents.

Here the config:

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      templates:
        - config:
            - type: container
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              multiline.type: pattern
              multiline.pattern: '^[[:space:]]'
              multiline.negate: false
              multiline.match: after

cloud.id: {{ elasticsearch_cloud_id }}
cloud.auth: {{ elasticsearch_user }}:{{ elasticsearch_password }}

Am I doing anything wrong?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.