Ingest mixed container logs with text and JSON [filebeat][docker]

Elastic Observability Logs
4

You can either set up your conditions so that they match on a particular label or add multiple conditions to the same template for all of your apps: Multiple conditions with autodiscover & docker containers - #2 by steffens

There's also a docker-based autodiscover so the k8s-style autodiscover example above would look like this for docker:

filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - condition:
            contains:
              docker.container.labels: "log-format-json-and-text"
          config:
            - type: container
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              include_lines: ['^{']
              json.keys_under_root: true
              json.overwrite_keys: true
              json.add_error_key: true
              json.expand_keys: true
        - condition:
            contains:
              docker.container.labels: "log-format-json-and-text"
          config:
            - type: container
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              exclude_lines: ['^{']
              multiline.pattern: '^[[:blank:]]'
              multiline.negate: false
              multiline.match: after

See Autodiscover | Filebeat Reference [8.11] | Elastic for more info about autodiscover.

What's not working with json.add_error_key: true? Is the unparseable JSON under the wrong key or is it completely absent from the indexed document?