From c774f53ef4938ad84fd4fb27b347a2f03db8e3d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carlos=20P=C3=A9rez-Aradros=20Herce?= Date: Tue, 9 Apr 2019 13:12:23 +0200 Subject: [PATCH] Update add_docker_metadata Behavior changed in #11577 --- libbeat/docs/processors-using.asciidoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libbeat/docs/processors-using.asciidoc b/libbeat/docs/processors-using.asciidoc index 41130c5d79a7..275639d490a6 100644 --- a/libbeat/docs/processors-using.asciidoc +++ b/libbeat/docs/processors-using.asciidoc @@ -1107,10 +1107,10 @@ process is running in Docker then the event will be enriched. The default value is `["process.pid", "process.ppid"]`. `match_source`:: (Optional) Match container ID from a log path present in the -`source` field. Enabled by default. +`log.file.path` field. Enabled by default. `match_short_id`:: (Optional) Match container short ID from a log path present -in the `source` field. Disabled by default. +in the `log.file.path` field. Disabled by default. This allows to match directories names that have the first 12 characters of the container ID. For example, `/var/log/containers/b7e3460e2b21/*.log`.