Cause: Fluentd is unable to correctly determine the docker log driver. It thinks the log driver is journald when it is json-file. Fluentd then looks for the `CONTAINER_NAME` field in the record to hold the kubernetes metadata and it is not present. Consequence: Fluentd is not able to add kubernetes metadata to records. Records go to the .orphaned index. Fluentd spews lots of errors like this: [error]: record cannot use elasticsearch index na me type project_full: record is missing kubernetes field Fix: Fluentd should not rely on reading the docker configuration file to determine if the record contains kubernetes metadata. It should look at both the record tag and the record data and use whatever kubernetes metadata it finds there. Result: Fluentd can correctly add kubernetes metadata and assign records to the correct indices no matter which log driver docker is using. Records read from files under /var/log/containers/*.log will have a fluentd tag like kubernetes.var.log.containers.**. This applies both to CRI-O and docker file logs. Kubernetes records read from journald with CONTAINER_NAME will have a tag like journal.kubernetes.**. There is no CRI-O journald log driver yet, and it is not clear how those records will be represented, but hopefully they will follow the same CONTAINER_NAME convention, in which case they will Just Work.