I guess it's close to my question "Ingest mixed container logs with text and JSON":
Can we easily combine text and structured JSON logging in the same container standard output? With JSON being parsed and non-parse-able data just saved in a text field? With a single configuration? (I got 50+ containers 
)
Maybe @felixbarny can help?