Filebeat json message parsing sample

filebeat.yml

filebeat.inputs:

  - type: docker
    combine_partial: true
    tags: ["my-tag-docker"]

    containers:
      path: "/var/lib/docker/containers"
      ids:
        - "*"

processors:
  - add_docker_metadata:
      when:
        contains:
          tags: "my-tag"
      host: "unix:///var/run/docker.sock"
 
  - add_tags:
      when:
        contains:
          container.labels.com_docker_compose_project: container_name
      tags: ["my-tag"]

  - decode_json_fields:
      fields: ["message"]
      process_array: false
      max_depth: 1
      target: ""
      overwrite_keys: false
      add_error_key: true

output.logstash:
  hosts: ["myhost.domain:9005"]

logging.level: debug
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644