Can filebeat decode embedded json string in a particular field

Elastic Stack Beats
1

We have docker json-file logger produces this kind of log messages (docker meta data removed)
{"log":"{"test":"test"}"}

Is it possible to configure filebeat5.0 to also decode the string inside "log"? Or we have to use something like Logstash Json filter.

2

You need to use LS.

3

It seems should be done at producing host. I can take a look to add an option in prospector or processor

4

This topic was automatically closed after 21 days. New replies are no longer allowed.