We are running Filebeat on Kubernetes to ingest nginx logs. Its going fine except for the fact that lines are not being parsed. The entire nginx log line shows up under "message" in elastic.
"message": "10.199.12.66 - - [08/Aug/2018:07:23:24 +0000] "POST /api/v0.1/elasticsearch/clusters-*/_search HTTP/1.1" 200 147857 "https://url/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36"",
Configuration is minimalistic.
- type: kubernetes
nginx kubernetes manifest
I have seen similar threads on the forum that has died after a while. Did anyone find a solution here?