# Missing event field from filebeat via docker autodiscovery

**URL:** https://discuss.elastic.co/t/missing-event-field-from-filebeat-via-docker-autodiscovery/302843
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [April 20, 2022, 5:06pm UTC](https://discuss.elastic.co/t/missing-event-field-from-filebeat-via-docker-autodiscovery/302843 "2022-04-20T17:06:46Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![galkinrost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/galkinrost/32/104600_2.png) [@galkinrost](https://discuss.elastic.co/u/galkinrost)
#### Post date: [April 20, 2022, 5:06pm UTC](https://discuss.elastic.co/t/missing-event-field-from-filebeat-via-docker-autodiscovery/302843/1 "2022-04-20T17:06:46Z")

</div>

Hi!

I'm trying to set up filebeat with docker autodiscovery. But for some reason the event field is missing in documents.

Here the config:

```auto
filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      templates:
        - config:
            - type: container
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              multiline.type: pattern
              multiline.pattern: '^[[:space:]]'
              multiline.negate: false
              multiline.match: after

cloud.id: {{ elasticsearch_cloud_id }}
cloud.auth: {{ elasticsearch_user }}:{{ elasticsearch_password }}

```

Am I doing anything wrong?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 18, 2022, 7:07pm UTC](https://discuss.elastic.co/t/missing-event-field-from-filebeat-via-docker-autodiscovery/302843/2 "2022-05-18T19:07:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.