Hi there shaunak,
Thanks for your response, I changed the output and have a line that should contain the docker metedata, and had to dig a bit to find the relevant log lines:
I switched filebeat output to file and inspected that, with below results ( I made some text replecements, which might have changed the json scheme a bit):
{"@timestamp":"2020-11-26T07:35:45.647Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.3"},"input":{"type":"container"},"agent":{"type":"filebeat","version":"7.9.3","hostname":"project-eck-filebeat-filebeat-hbjwz","ephemeral_id":"d955ea7d-e1d4-43d1-be8d-bd4f1917da59","id":"95808bf2-4248-4197-9bd7-9e3748a9e1ac","name":"project-eck-filebeat-filebeat-hbjwz"},"ecs":{"version":"1.5.0"},"host":{"name":"project-eck-filebeat-filebeat-hbjwz"},"log":{"file":{"path":"/var/lib/docker/containers/3523704f1862a3835621b3c0dabd33bee8d3160592982ae5bee7f7a78195fe87/3523704f1862a3835621b3c0dabd33bee8d3160592982ae5bee7f7a78195fe87-json.log"},"offset":90443},"stream":"stdout","message":"2020-11-26T07:35:45.644Z \u001b[32minfo\u001b[39m [shim:chaincode] smallValueTransferCheck outcome: undefined ","tags":["chaincode"]}
{"@timestamp":"2020-11-26T07:35:51.929Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.3"},"log":{"file":{"path":"/var/lib/docker/containers/fd7c7a10b13a6c9c3f597e9317788e45a86586dfcb92acac135bddd4f0f1c1db/fd7c7a10b13a6c9c3f597e9317788e45a86586dfcb92acac135bddd4f0f1c1db-json.log"},"offset":8548},"stream":"stdout","message":"2020-11-26T07:35:51.929Z \u001b[32minfo\u001b[39m [shim:chaincode] Invoke function [object Object] ","tags":["chaincode"],"input":{"type":"container"},"host":{"name":"project-eck-filebeat-filebeat-hbjwz"},"agent":{"name":"project-eck-filebeat-filebeat-hbjwz","type":"filebeat","version":"7.9.3","hostname":"project-eck-filebeat-filebeat-hbjwz","ephemeral_id":"d955ea7d-e1d4-43d1-be8d-bd4f1917da59","id":"95808bf2-4248-4197-9bd7-9e3748a9e1ac"},"ecs":{"version":"1.5.0"}}
{"@timestamp":"2020-11-26T07:35:43.477Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.3"},"agent":{"name":"project-eck-filebeat-filebeat-hbjwz","type":"filebeat","version":"7.9.3","hostname":"project-eck-filebeat-filebeat-hbjwz","ephemeral_id":"d955ea7d-e1d4-43d1-be8d-bd4f1917da59","id":"95808bf2-4248-4197-9bd7-9e3748a9e1ac"},"ecs":{"version":"1.5.0"},"log":{"offset":88129,"file":{"path":"/var/lib/docker/containers/3523704f1862a3835621b3c0dabd33bee8d3160592982ae5bee7f7a78195fe87/3523704f1862a3835621b3c0dabd33bee8d3160592982ae5bee7f7a78195fe87-json.log"}},"stream":"stdout","message":"2020-11-26T07:35:43.477Z \u001b[32minfo\u001b[39m [shim:lib/handler.js] [p0001-032b02a4] Calling chaincode Invoke() succeeded. Sending COMPLETED message back to peer ","tags":["chaincode"],"input":{"type":"container"},"host":{"name":"project-eck-filebeat-filebeat-hbjwz"}}
{"@timestamp":"2020-11-26T07:35:45.600Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.3"},"agent":{"version":"7.9.3","hostname":"project-eck-filebeat-filebeat-hbjwz","ephemeral_id":"d955ea7d-e1d4-43d1-be8d-bd4f1917da59","id":"95808bf2-4248-4197-9bd7-9e3748a9e1ac","name":"project-eck-filebeat-filebeat-hbjwz","type":"filebeat"},"ecs":{"version":"1.5.0"},"host":{"name":"project-eck-filebeat-filebeat-hbjwz"},"stream":"stdout","message":"2020-11-26T07:35:45.591Z \u001b[32minfo\u001b[39m [shim:chaincode] Retrieving valid <...> table with type parameters ","log":{"file":{"path":"/var/lib/docker/containers/5452dd3f6b32fbaea547452d689deae82ab1a1d6d7d7f06bc47049a8c574909b/5452dd3f6b32fbaea547452d689deae82ab1a1d6d7d7f06bc47049a8c574909b-json.log"},"offset":19131},"tags":["chaincode"],"input":{"type":"container"}}
{"@timestamp":"2020-11-26T07:35:39.288Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.3"},"stream":"stdout","message":"2020-11-26T07:35:39.286Z \u001b[32minfo\u001b[39m [shim:chaincode] invoking/querying function {\"fcn\":\"updateSharedData\",\"params\":["chaincode"],"input":{"type":"container"},"ecs":{"version":"1.5.0"},"host":{"name":"project-eck-filebeat-filebeat-hbjwz"},"agent":{"type":"filebeat","version":"7.9.3","hostname":"project-eck-filebeat-filebeat-hbjwz","ephemeral_id":"d955ea7d-e1d4-43d1-be8d-bd4f1917da59","id":"95808bf2-4248-4197-9bd7-9e3748a9e1ac","name":"project-eck-filebeat-filebeat-hbjwz"},"log":{"offset":83528,"file":{"path":"/var/lib/docker/containers/3523704f1862a3835621b3c0dabd33bee8d3160592982ae5bee7f7a78195fe87/3523704f1862a3835621b3c0dabd33bee8d3160592982ae5bee7f7a78195fe87-json.log"}}}
{"@timestamp":"2020-11-26T07:35:38.190Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.3"},"kubernetes":{"statefulset":{"name":"hlf-<...>-peer0"},"labels":{"app":"hlf-<...>-peer0","controller-revision-hash":"hlf-<...>-peer0-686597b4fb","name":"hlf-peer","org":"hlf-peer","statefulset_kubernetes_io/pod-name":"hlf-peer--<...>peer0-0"},"container":{"name":"peer","image":"hyperledger/fabric-peer:1.4.7"},"node":{"name":"aks-agentpool-19422743-0"},"pod":{"name":"<...>--peer0-0","uid":"c7e29fe9-936c-49af-b14a-59d38b0a7afb"},"namespace":"hlf"},"ecs":{"version":"1.5.0"},"tags":["chaincode"],"container":{"image":{"name":"hyperledger/fabric-peer:1.4.7"},"id":"f5ebad3aa6f4e159637dd2ae04fcf5e490fd3d70cbeb4d58f87107d96dcddd31","runtime":"docker"},"log":{"file":{"path":"/var/lib/docker/containers/f5ebad3aa6f4e159637dd2ae04fcf5e490fd3d70cbeb4d58f87107d96dcddd31/f5ebad3aa6f4e159637dd2ae04fcf5e490fd3d70cbeb4d58f87107d96dcddd31-json.log"},"offset":723565},"input":{"type":"container"},"host":{"name":"project-eck-filebeat-filebeat-hbjwz"},"agent":{"version":"7.9.3","hostname":"project-eck-filebeat-filebeat-hbjwz","ephemeral_id":"d955ea7d-e1d4-43d1-be8d-bd4f1917da59","id":"95808bf2-4248-4197-9bd7-9e3748a9e1ac","name":"project-eck-filebeat-filebeat-hbjwz","type":"filebeat"},"stream":"stderr","message":"\u001b[34m2020-11-26 07:35:38.187 UTC [comm.grpc.server] 1 -> INFO 7b0\u001b[0m unary call completed grpc.service=protos.Endorser grpc.method=ProcessProposal grpc.peer_address=10.244.3.49:53770 grpc.code=OK grpc.call_duration=85.107901ms"}
{"@timestamp":"2020-11-26T07:34:31.559Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.3"},"input":{"type":"container"},"ecs":{"version":"1.5.0"},"host":{"name":"project-eck-filebeat-filebeat-hbjwz"},"stream":"stderr","message":"2020-11-26T07:34:31.556Z\tERROR\t[kubernetes]\tadd_kubernetes_metadata/matchers.go:91\tError extracting container id - source value does not contain matcher's logs_path '/var/lib/docker/containers/*/'.","tags":["chaincode"],"container":{"image":{"name":"docker.elastic.co/beats/filebeat:7.9.3"},"id":"7f13761cb517676f1fa910bf99f5c7d7a12e8bc77b140f9b914a297ff4c3d0bb","runtime":"docker"},"kubernetes":{"namespace":"elastic-system","labels":{"controller-revision-hash":"56b8766d7c","heritage":"Tiller","pod-template-generation":"14","release":"project-eck-filebeat","app":"project-eck-filebeat-filebeat","chart":"filebeat-7.9.3"},"container":{"name":"filebeat","image":"docker.elastic.co/beats/filebeat:7.9.3"},"node":{"name":"aks-agentpool-19422743-0"},"pod":{"name":"project-eck-filebeat-filebeat-hbjwz","uid":"a6f5b82d-dea4-4ef9-a0da-c0c4d5027cea"}},"agent":{"version":"7.9.3","hostname":"project-eck-filebeat-filebeat-hbjwz","ephemeral_id":"d955ea7d-e1d4-43d1-be8d-bd4f1917da59","id":"95808bf2-4248-4197-9bd7-9e3748a9e1ac","name":"project-eck-filebeat-filebeat-hbjwz","type":"filebeat"},"log":{"offset":31086509,"file":{"path":"/var/lib/docker/containers/7f13761cb517676f1fa910bf99f5c7d7a12e8bc77b140f9b914a297ff4c3d0bb/7f13761cb517676f1fa910bf99f5c7d7a12e8bc77b140f9b914a297ff4c3d0bb-json.log"}}}
{"@timestamp":"2020-11-26T07:34:31.559Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.3"},"kubernetes":{"pod":{"name":"project-eck-filebeat-filebeat-hbjwz","uid":"a6f5b82d-dea4-4ef9-a0da-c0c4d5027cea"},"namespace":"elastic-system","labels":{"chart":"filebeat-7.9.3","controller-revision-hash":"56b8766d7c","heritage":"Tiller","pod-template-generation":"14","release":"project-eck-filebeat","app":"project-eck-filebeat-filebeat"},"container":{"name":"filebeat","image":"docker.elastic.co/beats/filebeat:7.9.3"},"node":{"name":"aks-agentpool-19422743-0"}},"agent":{"type":"filebeat","version":"7.9.3","hostname":"project-eck-filebeat-filebeat-hbjwz","ephemeral_id":"d955ea7d-e1d4-43d1-be8d-bd4f1917da59","id":"95808bf2-4248-4197-9bd7-9e3748a9e1ac","name":"project-eck-filebeat-filebeat-hbjwz"},"host":{"name":"project-eck-filebeat-filebeat-hbjwz"},"ecs":{"version":"1.5.0"},"log":{"offset":31086797,"file":{"path":"/var/lib/docker/containers/7f13761cb517676f1fa910bf99f5c7d7a12e8bc77b140f9b914a297ff4c3d0bb/7f13761cb517676f1fa910bf99f5c7d7a12e8bc77b140f9b914a297ff4c3d0bb-json.log"}},"stream":"stderr","message":"2020-11-26T07:34:31.556Z\tERROR\t[kubernetes]\tadd_kubernetes_metadata/matchers.go:91\tError extracting container id - source value does not contain matcher's logs_path '/var/lib/docker/containers/*/'.","tags":["chaincode"],"input":{"type":"container"},"container":{"runtime":"docker","image":{"name":"docker.elastic.co/beats/filebeat:7.9.3"},"id":"7f13761cb517676f1fa910bf99f5c7d7a12e8bc77b140f9b914a297ff4c3d0bb"}}
the last three lines show logs that I want to filter out, it looks like they have more data fields than the ones in the earlier lines.
Am I correct in identifying missing container metada here?