Worst case

gistfile1.txt

{
  "container": {
    "name": "k8s_nginx-system_nginx-system-green-deployment-84c89bf49d-nfmvp_green_edb6d44b-d265-11ea-915e-42010a800009_0",
    "image": {
      "name": "sha256:3fd39c2bfa01412c773dd0910c871775a09f4ff7fa0028b3394f3a2313210260"
    },
    "id": "f03d7d7c62cbb100eb2e9929a30dd567b1e82a276d75fb8be80fe9afd4ef0dba",
    "labels": {
      "annotation_io_kubernetes_pod_terminationGracePeriod": "30",
      "annotation_io_kubernetes_container_terminationMessagePolicy": "File",
      "maintainer": "Evan Wies <evan@neomantra.net>",
      "io_kubernetes_pod_namespace": "green",
      "io_kubernetes_container_logpath": "/var/log/pods/green_nginx-system-green-deployment-84c89bf49d-nfmvp_edb6d44b-d265-11ea-915e-42010a800009/nginx-system/0.log",
      "io_kubernetes_sandbox_id": "2337b9216097951a2ef8af32e7f4fb49070f11815b2419e8e089f3e9d5a00bc1",
      "org_label-schema_schema-version": "= 1.0     org.label-schema.name=CentOS Base Image     org.label-schema.vendor=CentOS     org.label-schema.license=GPLv2     org.label-schema.build-date=20180402",
      "resty_rpm_version": "1.13.6.2-1.el7.centos",
      "io_kubernetes_container_name": "nginx-system",
      "annotation_io_kubernetes_container_hash": "5acfc3e6",
      "annotation_io_kubernetes_container_terminationMessagePath": "/dev/termination-log",
      "resty_rpm_arch": "x86_64",
      "io_kubernetes_pod_name": "nginx-system-green-deployment-84c89bf49d-nfmvp",
      "io_kubernetes_pod_uid": "edb6d44b-d265-11ea-915e-42010a800009",
      "annotation_io_kubernetes_container_ports": """[{"name":"status","containerPort":8080,"protocol":"TCP"},{"name":"kibana","containerPort":80,"protocol":"TCP"}]""",
      "resty_luarocks_version": "2.4.4",
      "annotation_io_kubernetes_container_restartCount": "0",
      "io_kubernetes_docker_type": "container",
      "resty_rpm_flavor": ""
    }
  },
  "log": {
    "file": {
      "path": "/var/lib/docker/containers/f03d7d7c62cbb100eb2e9929a30dd567b1e82a276d75fb8be80fe9afd4ef0dba/f03d7d7c62cbb100eb2e9929a30dd567b1e82a276d75fb8be80fe9afd4ef0dba-json.log"
    },
    "offset": 1431572
  },
  "kubernetes": {
    "namespace": "green",
    "container": {
      "name": "nginx-system",
      "image": "openresty/openresty:1.13.6.2-0-centos"
    },
    "replicaset": {
      "name": "nginx-system-green-deployment-84c89bf49d"
    },
    "labels": {
      "app": "nginx-system",
      "heartbeat_type": "http",
      "pod-template-hash": "84c89bf49d",
      "heartbeat_port": "8080"
    },
    "pod": {
      "uid": "edb6d44b-d265-11ea-915e-42010a800009",
      "name": "nginx-system-green-deployment-84c89bf49d-nfmvp"
    },
    "node": {
      "name": "gke-demo-elastic-co-default-pool-d2239e75-ktze"
    }
  },
  "host": {
    "mac": [
      "0a:1a:9a:e9:41:b6"
    ],
    "hostname": "filebeat-demo-green-l6sb5",
    "architecture": "x86_64",
    "containerized": false,
    "ip": [
      "10.12.8.81"
    ],
    "name": "filebeat-demo-green-l6sb5",
    "os": {
      "platform": "centos",
      "family": "redhat",
      "version": "7 (Core)",
      "kernel": "4.14.138+",
      "name": "CentOS Linux",
      "codename": "Core"
    },
    "id": "83a8f1f835d84a9a9bf5417cecaf0c8e"
  },
  "cloud": {
    "project": {
      "id": "elastic-product"
    },
    "provider": "gcp",
    "instance": {
      "name": "gke-demo-elastic-co-default-pool-d2239e75-ktze",
      "id": "4185994108039115136"
    },
    "availability_zone": "us-central1-a",
    "machine": {
      "type": "n1-standard-32"
    }
  },
  "agent": {
    "hostname": "filebeat-demo-green-l6sb5",
    "name": "filebeat-demo-green-l6sb5",
    "ephemeral_id": "f4aa9965-b74b-4a14-ad52-b8449d0ba937",
    "version": "7.8.0",
    "type": "filebeat",
    "id": "596fa15f-7bcc-4f4e-b988-b2a12c5e76bc"
  },
  "stream": "stdout",
  "@timestamp": "2020-08-17T03:41:47.000Z",
  "event": {
    "timezone": "+00:00",
    "module": "nginx",
    "dataset": "nginx.access"
  },
  "fileset": {
    "name": "access"
  },
  "input": {
    "type": "docker"
  },
  "service": {
    "type": "nginx"
  },
  "ecs": {
    "version": "1.5.0"
  },
  "message": "212.240.41.30 - aburke [17/Aug/2020:03:41:47 +0000] \"GET /status HTTP/1.1\" 200 111531 \"\" \"Elastic-Heartbeat/7.8.0 (linux; amd64; f79387d32717d79f689d94fda1ec80b2cf285d30; 2020-06-14 17:31:16 +0000 UTC)\"",
  "data_stream": {
    "type": "logs",
    "namespace": "default",
    "dataset": "nginx.access"
  }
}