Docker logs interpreting JSON logs as string

Question

Our Go server outputs logs to stdout in JSON, each line looking something like the following:

{"time": "2017-06-01 14:00:00", "message": "Something happened", "level": "DEBUG"}

Our docker-compose uses the standard json-file logger, which wraps each line in a log field as an escaped string, like so:

{
  "log": "{\"time\": \"2017-06-01 14:00:00\", \"message\": \"Something happened\", \"level\": \"DEBUG\"}\"",
  "timestamp": "<the time>",
  ...more fields...
}

But we don't want the log field to be escaped as a string, we want it embedded as JSON at the same level:

{
  "log": {
     "time": "2017-06-01 14:00:00", 
     "message": "Something happened", 
     "level": "DEBUG"
  },
  "timestamp": "<the time>",
  ...more fields...
}

Can this be achieved?

Answer 1

Looks like this can't be done. But I can convert the JSON string to actual JSON in Filebeat, which we are using to pass logs to Kibana and Elastalert. To do that I used the decode_json_fields option under processors in filebeat.yml .