Hi,
I meant, logs lines were transferred to ElasticSearch but not parsed.
If I leave only 'access' - then it's ok (but only these lines).
In nginx container - they do a symlink from error log to stderr, and from access log to stdout - In terms of Docker, you see only one file ---container-id---.json in var/lib/docker/containers/---container-id--
Asher