elastic / elastic/integrations

[docker]: ANSI escape sequences in log messages

Open
#11,874 2 comments 0 reactions 0 assignees View on GitHub
Integration:docker needs:triage Team:Cloudnative-Monitoring
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Docker [docker]

### Dataset Name

docker.container_logs

### Integration Version

2.12.0

### Agent Version

8.15.4

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.15.4

### OS Version and Architecture

Debian 11.11

### Software/API Version

_No response_

### Error Message

With the default installation docker logs contain ANSI escape sequences to display fancy colors. These should be removed by default.

### Event Original

_No response_

### What did you do?

Currently I am doing the following in the `logs-docker.container_logs@custom` Pipeline:

```
[
{
"gsub": {
"field": "message",
"pattern": "\\x1B\\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|M|K]",
"replacement": "",
"ignore_missing": true,
"description": "mutate-ansii-colours in message"
}
},
{
"gsub": {
"field": "log.level",
"pattern": "\\x1B\\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|M|K]",
"replacement": "",
"ignore_missing": true,
"description": "mutate-ansii-colours in log.level"
}
}
]
```

This is from [Jason Neurohr's blog entry](https://www.jasonneurohr.com/articles/removing-ascii-colour-codes-from-log-events-in-logstash/).

### What did you see?

ANSI sequences

### What did you expect to see?

No ANSI sequences.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.