Parse docker logs with logstash

I have a docker container that log to stdout/stderr. Docker save it’s output into /var/lib/docker/containers//-logs.json

The log has lines with the following structure

  • .NET Core Container Built with VSTS won't run on Linux
  • Docker - Karaf image with Mongo Image
  • Symlinked Dockerfile for environments
  • Mounting volumes on Bluemix containers and sharing between them does not work
  • linux container display wrong information
  • How to install zless in alpine linux?
  • {"log":"This is a message","stream":"stderr","time":"2015-03-12T19:27:27.310818102Z"}

    which input/codec/filter should I use to get only the log field as the message ?


  • where does docker attach volume on host machine when its not specified?
  • Kitematic Setup Error Docker
  • Reproducible Docker builds - long-term storage/restoring
  • Trigger automated Docker Hub build on another public GitHub repo change
  • Docker-selenium-chrome View Browser
  • ansible-container variables in playbook
  • One Solution collect form web for “Parse docker logs with logstash”

    Use the json codec to parse the JSON string (you could instead use the json filter), then rename the “log” field to “message” with the mutate filter and finally use the date filter to parse the “time” field.

    filter {
      mutate {
        rename => ["log", "message"]
      date {
        match => ["time", "ISO8601"]
        remove_field => ["time"]
    Docker will be the best open platform for developers and sysadmins to build, ship, and run distributed applications.