Parsing JSON in JSON (docker logs)


We are parsing docker logs using filebeat 5. We parse the JSON using the following options:

json.message_key: log
json.keys_under_root: true
json.add_error_key: true

However, the log messages from the docker container are being generated using logstash-logback-encoder and are structured logs in JSON. So ideally I want to parse the JSON docker log, then parse the value of the log key in JSON again.

e.g. docker log file entry:
{"log":"{"msg": "hello", "level": "WARN"}","stream":"stdout","time":"2016-11-10T12:55:37.707457521Z"}

I would like to get msg and level as keys in the elasticsearch entry.

Is this possible?


(Steffen Siering) #2

Sounds like this PR could become helpful in the future. Right now, additional json decoding must be done in logstash or via elasticsearch ingest node.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.