IssueTracker

What you would like to accomplish

Structure Docker logs with Ops Agent and preserve the keys that Docker provides in the logs.

The logging Ops agent uses the key field to structure Docker log as jsonPayload but after creating the structure it removes the key and other keys provided by Docker.

How this might work

Standard docker log using the driver: json-file:

{"log":"{\"key\":\"value\"}\n","stream":"stdout","time":"..."}

The log would change from this structure:

{
  "jsonPayload": {
      "key": "value"
  }
}

To this structure with the “log” and “time” key that is used in the Ops agent processor:

{
  "jsonPayload": {
    "log": {
      "key": "value"
    },
    time: "..."
  }
}

If applicable, reasons why alternative solutions are not sufficient

Tried using other processors to achieve that structure, but they each have their own set of drawbacks:

• parse_regex: Requires manual RegEx configuration, which can go wrong for different and bigger outputs.

• parse_json in combination with modify_fields: I tried to create some kind of nested fields but because Docker logs are not supported it did not structure the logs.