We are parsing docker logs using filebeat 5. We parse the JSON using the following options:
json.message_key: log
json.keys_under_root: true
json.add_error_key: true
However, the log messages from the docker container are being generated using logstash-logback-encoder and are structured logs in JSON. So ideally I want to parse the JSON docker log, then parse the value of the log key in JSON again.
e.g. docker log file entry:
{"log":"{"msg": "hello", "level": "WARN"}","stream":"stdout","time":"2016-11-10T12:55:37.707457521Z"}
I would like to get msg and level as keys in the elasticsearch entry.
Is this possible?
Regards,
Jeff