Parsing JSON in JSON (docker logs)

We are parsing docker logs using filebeat 5. We parse the JSON using the following options:

json.message_key: log
json.keys_under_root: true
json.add_error_key: true

However, the log messages from the docker container are being generated using logstash-logback-encoder and are structured logs in JSON. So ideally I want to parse the JSON docker log, then parse the value of the log key in JSON again.

e.g. docker log file entry:
{"log":"{"msg": "hello", "level": "WARN"}","stream":"stdout","time":"2016-11-10T12:55:37.707457521Z"}

I would like to get msg and level as keys in the elasticsearch entry.

Is this possible?

Regards,
Jeff

Sounds like this PR could become helpful in the future. Right now, additional json decoding must be done in logstash or via elasticsearch ingest node.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.