cscli parsers install crowdsecurity/docker-logsThis is the default docker json logs format parser. It works on kubernetes using docker.
When using this parser, you need to specify in your acquis.yaml type and program. So your log will be extracted and then sent to the proper next parser using the program key.
example:
labels:
type: docker
program: nginx1#If it's docker, we are going to extract log line from it2filter: "evt.Line.Labels.type == 'docker'"3onsuccess: next_stage4name: crowdsecurity/docker-logs5description: docker json logs parser6statics:7 - target: evt.StrTime8 expression: JsonExtract(evt.Line.Raw, "time")9 - parsed: message10 expression: JsonExtractUnescape(evt.Line.Raw, "log")11 - parsed: program12 expression: evt.Line.Labels.program