<source>
@id container.log
@type tail
format json
path /home/docker/containers/*/*-json.log
pos_file /var/log/container.log.pos
time_format %Y-%m-%dT%H:%M:%S.%NZ
tag docker.*
read_from_head true
</source>
# Using filter to add container IDs to each event
<filter docker.home.docker.containers.*.*.log>
@type record_transformer
<record>
container_id ${tag_parts[4]}
</record>
</filter>