<source> @id container.log @type tail format json path /home/docker/containers/*/*-json.log pos_file /var/log/container.log.pos time_format %Y-%m-%dT%H:%M:%S.%NZ tag docker.* read_from_head true </source> # Using filter to add container IDs to each event <filter docker.home.docker.containers.*.*.log> @type record_transformer <record> container_id ${tag_parts[4]} </record> </filter>