Mixed document types: json and plain text

We are migrating all of our applications to use the JSON encoded format, but until then we have some log files in json and some with normal logs.
We cannot differentiate them using different paths because all of them are Docker containers logging under:

Is there a solution to parse them or do we need to use two different Filebeat instances?

@mimmus You cannot differentiate by filename either?

I am not sure if the following would work, I haven't tried it, but maybe you could use the decode_json_field on the message field and a when conditionals to match the begining { of a JSON document. I am not sure that will work in all the cases because Docker can split JSON lines.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.