Parse nginx ingress logs in fluentd
<p>I'd like to parse ingress nginx logs using fluentd in Kubernetes. That was quite easy in Logstash, but I'm confused regarding fluentd syntax.</p>

<p>Right now I have the following rules:</p>

<pre><code>&lt;source&gt;
  type tail
  path /var/log/containers/*.log
  pos_file /var/log/es-containers.log.pos
  time_format %Y-%m-%dT%H:%M:%S.%NZ
  tag kubernetes.*
  format json
  read_from_head true
  keep_time_key true
&lt;/source&gt;

&lt;filter kubernetes.**&gt;
  type kubernetes_metadata
&lt;/filter&gt;
</code></pre>

<p>And as a result I get this log but it is unparsed:</p>

<pre><code>127.0.0.1 - [127.0.0.1] - user [27/Sep/2016:18:35:23 +0000] "POST /elasticsearch/_msearch?timeout=0&amp;ignore_unavailable=true&amp;preference=1475000747571 HTTP/2.0" 200 37593 "http://localhost/app/kibana" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Centos Chromium/52.0.2743.116 Chrome/52.0.2743.116 Safari/537.36" 951 0.408 10.64.92.20:5601 37377 0.407 200
</code></pre>

<p>I'd like to apply filter rules to be able to search by IP address, HTTP method, etc in Kibana. How can I implement that?</p>