The JSON parser is the simplest option: if the original log source is a JSON map string, it will take its structure and convert it directly to the internal binary representation.
A simple configuration that can be found in the default parsers configuration file, is the entry to parse Docker log files (when the tail input plugin is used):
1
[PARSER]
2
Name docker
3
Format json
4
Time_Key time
5
Time_Format %Y-%m-%dT%H:%M:%S %z
Copied!
The following log entry is a valid content for the parser defined above: