CODEWITHSUNDEEP
dockerlogstash
Gustavo Chaín
Gustavo Chaín

Reputation: 943

Parse docker logs with logstash

I have a docker container that log to stdout/stderr. Docker save it's output into /var/lib/docker/containers//-logs.json

The log has lines with the following structure

{"log":"This is a message","stream":"stderr","time":"2015-03-12T19:27:27.310818102Z"}

which input/codec/filter should I use to get only the log field as the message ?

Thanks!

Upvotes: 1

Views: 3631

Answers (1)

Magnus Bäck
Magnus Bäck

Reputation: 11581

Use the json codec to parse the JSON string (you could instead use the json filter), then rename the "log" field to "message" with the mutate filter and finally use the date filter to parse the "time" field.

filter {
  mutate {
    rename => ["log", "message"]
  }
  date {
    match => ["time", "ISO8601"]
    remove_field => ["time"]
  }
}

Upvotes: 2

Related Questions