Hey @David_Oceans,
Are you using autodiscover to collect the logs from your cluster? If that is the case you can setup different configurations per container to parse their logs.
For many services there are predefined modules that can be used, there are no module yet for ambassador, but maybe other modules for web servers as the one for apache or nginx are able to parse these logs.
If not, you can also try to parse it using processors, for example the dissect one could be able to parse these logs.
If filebeat processors are not enough, you can also use ingest pipelines.
In any case, feel free to open a new issue requesting support for ambassador, describing your use case.
Thanks!