I found the solution for my case. This is now my filebeat.yml file
filebeat.autodiscover:
providers:
- type: docker
templates:
- config:
- type: container
paths:
- "/var/lib/docker/containers/${data.docker.container.id}/*.log"
multiline.pattern: "^\t"
multiline.negate: false
multiline.match: after
logging.metrics.enabled: false
output.logstash:
hosts:
- logstash:5044
I had the three multiline lines at the wrong "level". Originally they were right between the - type: docker and templates: lines.