My application logs in json format like
{"verified": true, "id": 42, "date": "bla"}
and I want to forward this as json with filebeat (6.2.4). However, because the applications runs inside docker, the log is written to /var/lib/docker/containers//_json.log as:
{"log":"{\"verified\": true, \"id\": 42, \"date\": \"bla\"}\r\n","stream":"stdout","time":"2018-08-10T08:13:53.219511878Z"}
So now there is a json element log with a string value.
When filebeat parses the docker-log file, the content the log value is interpreted as a simple string and filebeat produces this output:
...
"log": "{\"verified\": true, \"id\": 42, \"date\": \"bla\"}",
"time": "2018-08-10T09:00:15.038787209Z",
"stream": "stdout",
...
Is it possible to parse the field "log" in filebeat so that the filebeat output contains the json elements verified, id and date.
This is my configuration:
filebeat.autodiscover:
providers:
- type: docker
templates:
- condition:
contains.docker.container.image: logprod
config:
- type: log
paths:
- /var/lib/docker/containers/${data.docker.container.id}/*.log
json.message_key: log
json.add_error_key: true
json.keys_under_root: true
output.console:
enabled: true
pretty: true
