What is the behavior with text logs (not json)?

[ddelporte]

We have an warning in fluentd logs 2019-11-19 09:18:12 +0000 [warn]: #0 dump an error event: error_class=Fluent::Plugin::Parser::ParserError error="pattern not matched with data 'error level - simple message to display'" location=nil tag="app.main-log-plain" time=1574155092 record={"container_name"=>"/efk_app-log-plain_1", "source"=>"stderr", "log"=>"error level - simple message to display", "container_id"=>"b19f6a2769f6a60bbc0629b9d28e952ebbc2465298a0caa4ac87ebbbf573b53d"}

So we have to define and match tag. For example I use

<filter json.app.**>
  @type parser
  format json
  key_name log
  reserve_data true
</filter>

and on docker-compose side

tag: json.app.main
tag: plain.app.main-log-plain