fluentd filter config for parsing nested json log messages in k8s-plugin-enriched entries

fluentd_nested_json.conf

# Fixes parsing nested json in the docker json logs
<filter kubernetes.**>
  @id filter_parser
  @type parser
  key_name log
  reserve_data false
  remove_key_name_field true
  # use parent @timestamp if can't parse a time field
  replace_invalid_sequence true
  reserve_time true
  # prefix parsed nested json fields with "data."
  inject_key_prefix data.
  <parse>
    @type multi_format
    <pattern>
      format json
      json_parser json
    </pattern>
    <pattern>
      format none
    </pattern>
  </parse>
</filter>

investigation from:

• uken/fluent-plugin-elasticsearch#521
• uken/fluent-plugin-elasticsearch#828