Logstash watch docker logs

logstash_docker.conf

input {
  file {
    codec => json
    path => '/var/lib/docker/containers/*/*-json.log'
  }
}
filter {
  ruby {
    code => "Thread.current[event['path']] ||= JSON.parse(Pathname(event['path']).dirname.join('config.json').read)"
  }
  ruby {
    code => "event['container_name'] = Thread.current[event['path']].fetch('Name', '<missing>')"
  }
  ruby {
    code => "event['container_image'] = Thread.current[event['path']]['Config'].fetch('Image', '<missing>')"
  }
}
output {
  stdout {
    codec => rubydebug
  }
}