Hi @darkl0rd,
Thank you for testing Filebeat and providing feedback!
It seems mapping failed due to some of your labels, com.docker.swarm.task is currently holding an object, and a single keyword is being indexed (and failing). From what I see you probably have a set of lables like this:
"com.docker.swarm.task": "",
"com.docker.swarm.task.id": "xxxxx",
"com.docker.swarm.task.name": "xxxxx"
This is an issue we have recently fixed (yet to be released), and it's related to the dots in label names and how Elasticsearch stores them.
Something you could do as of today is ignoring the com.docker.swarm.task field from Filebeat side, to avoid mapping errors. You can do that by using the drop_field processor:
processors:
- drop_fields:
fields:
- `docker.container.labels.com.docker.swarm.task`