Add JSON log parsing

[DebakelOrakel]

Checklist

• Keep pull requests small so they can be easily reviewed.
• Update the documentation.
• Categorize the PR by setting a good title and adding one of the labels:
  bug, enhancement, documentation, change, breaking, dependency
  as they show up in the changelog
• Link this PR to related issues.

[DebakelOrakel]

Depends on #14

[simu]

Please finish and merge #14 first and rebase this afterwards, it's unclear which changes belong to this PR and which belong to #14 currently.

[simu]

Implementation looks good.

Does this also affect logs which are ingested into the default cluster-logging Elasticsearch? That's not very clear from the documentation.

PS: why are there 15 commits in this PR?

[DebakelOrakel]

Does this also affect logs which are ingested into the default cluster-logging Elasticsearch? That's not very clear from the documentation.
It does affect all logs. It works like this:

• it tries to parse the message field to json and saves it in a new field structured
• if the pod (depending on configuration) has a label logformat=apache it creates a new index app-apache-xxxxx where the structured fields are indexed and searchable
• if it cant parse the message field no structured field is created
• only application logs are affected

PS: why are there 15 commits in this PR?
I was wondering that either, probably bc i checked out from the other branch...

[simu]

PS: why are there 15 commits in this PR?

I was wondering that either, probably bc i checked out from the other branch...

Looking at the commits in more detail, it's probably because you used GitHub's "Update Branch" which just merges master into the feature branch instead of rebasing the feature branch on the latest master.

[corvus-ch]

LGTM except for the git history. Please rebase.

[DebakelOrakel]

WTF... git, are you mad?