Can filebeat decode embedded json string in a particular field


#1

We have docker json-file logger produces this kind of log messages (docker meta data removed)
{"log":"{"test":"test"}"}

Is it possible to configure filebeat5.0 to also decode the string inside "log"? Or we have to use something like Logstash Json filter.


(Mark Walkom) #2

You need to use LS.


#3

It seems should be done at producing host. I can take a look to add an option in prospector or processor


(system) #4

This topic was automatically closed after 21 days. New replies are no longer allowed.