Mixed document types: json and plain text

[mimmus]

We are migrating all of our applications to use the JSON encoded format, but until then we have some log files in json and some with normal logs.
We cannot differentiate them using different paths because all of them are Docker containers logging under:
/var/lib/docker/containers/*/*.log

Is there a solution to parse them or do we need to use two different Filebeat instances?

[pierhugues (Pier-Hugues Pellerin)]

@mimmus

We are migrating all of our applications to use the JSON encoded format, but until then we have some log files in json and some with normal logs.
We cannot differentiate them using different paths because all of them are Docker containers logging under:
/var/lib/docker/containers/*/*.log

@mimmus You cannot differentiate by filename either?

I am not sure if the following would work, I haven't tried it, but maybe you could use the decode_json_field on the message field and a when conditionals to match the begining { of a JSON document. I am not sure that will work in all the cases because Docker can split JSON lines.