Moderate Case

moderate.json

{
  "log": {
    "file": {
      "path": "/var/lib/docker/containers/f03d7d7c62cbb100eb2e9929a30dd567b1e82a276d75fb8be80fe9afd4ef0dba/f03d7d7c62cbb100eb2e9929a30dd567b1e82a276d75fb8be80fe9afd4ef0dba-json.log"
    },
    "offset": 1431572
  },
  "host": {
    "mac": [
      "0a:1a:9a:e9:41:b6"
    ],
    "hostname": "filebeat-demo-green-l6sb5",
    "architecture": "x86_64",
    "containerized": false,
    "ip": [
      "10.12.8.81"
    ],
    "name": "filebeat-demo-green-l6sb5",
    "os": {
      "platform": "centos",
      "family": "redhat",
      "version": "7 (Core)",
      "kernel": "4.14.138+",
      "name": "CentOS Linux",
      "codename": "Core"
    },
    "id": "83a8f1f835d84a9a9bf5417cecaf0c8e"
  },
  "agent": {
    "hostname": "filebeat-demo-green-l6sb5",
    "name": "filebeat-demo-green-l6sb5",
    "ephemeral_id": "f4aa9965-b74b-4a14-ad52-b8449d0ba937",
    "version": "7.8.0",
    "type": "filebeat",
    "id": "596fa15f-7bcc-4f4e-b988-b2a12c5e76bc"
  },
  "stream": "stdout",
  "@timestamp": "2020-08-17T03:41:47.000Z",
  "event": {
    "timezone": "+00:00",
    "module": "nginx",
    "dataset": "nginx.access"
  },
  "fileset": {
    "name": "access"
  },
  "input": {
    "type": "docker"
  },
  "service": {
    "type": "nginx"
  },
  "ecs": {
    "version": "1.5.0"
  },
  "message": "212.240.41.30 - aburke [17/Aug/2020:03:41:47 +0000] \"GET /status HTTP/1.1\" 200 111531 \"\" \"Elastic-Heartbeat/7.8.0 (linux; amd64; f79387d32717d79f689d94fda1ec80b2cf285d30; 2020-06-14 17:31:16 +0000 UTC)\"",
  "data_stream": {
    "type": "logs",
    "namespace": "default",
    "dataset": "nginx.access"
  }
}