Filebeat add_docker_metadata processor not working if filebeat starts before docker

[kkensy]

Filebeat add_docker_metadata processor is not working if filebeat starts before docker. First seen with rootless docker. Tested with rootless and rootfull docker.

• Version: 9.0.2
• Operating System: Debian 12
• Steps to Reproduce:

1. Configure Filebeat to read docker container logs with the use of the add_docker_metadata processor.
2. Generate some logs:
   docker run -d --restart unless-stopped alpine:latest sh -c 'for i in `seq 1 999`; do sleep 1; echo $i; done'
3. 3. Check the appended metadata in output (present - as expected).
4. Restart filebeat: systemctl restart filebeat.service
5. Check the appended metadata in output (present - as expected).
6. Stop docker: systemctl stop docker.service docker.socket
7. Restart filebeat: systemctl restart filebeat.service
8. Start docker: systemctl start docker.service
9. Check the appended metadata in output (missing - not expected).
10. Restart filebeat: systemctl restart filebeat.service
11. Check the appended metadata in output (present - as expected).

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)