Can filebeat decode embedded json string in a particular field


We have docker json-file logger produces this kind of log messages (docker meta data removed)

Is it possible to configure filebeat5.0 to also decode the string inside "log"? Or we have to use something like Logstash Json filter.

(Mark Walkom) #2

You need to use LS.


It seems should be done at producing host. I can take a look to add an option in prospector or processor

(system) #4

This topic was automatically closed after 21 days. New replies are no longer allowed.