Structured logging with Filebeat

[vharabor (Vladimir)]

We have 5 different docker images doing their own thing.

This post helped me get a little closer but I was hoping to find a more generic solution to parse key value pairs.

Using Grok with KV filter

Hi, I am pretty new to ELK stack. Currently I am trying to parse my application log using grok pattern. But since my logs are not structured i may have to write too many grok conditions, which will not scale well. Sample log: 2019-02-25 10:22:27,832 LL="INFO" field1="field value" field2="field2val" MTHD="POST" O="ipadd" PAYLOAD="{"errorResponse":{"status":403,"message":"some message.","reason":"some reason"}}" using KV filter I cant parse the above log, as the payload is not parsable using KV…

If we switched to json logging, would that be easier to parse?