title: Parsing log containing JSON in Fluentd
body: <p>I'm using Fluentd to tail container logs in k8s. I'm using the <code>in_tail</code> input plugin to tail container logs, parsing using the <code>regexp</code> parse plugin to extract the relevant log. The log is a json that has to be extracted and sent to the output plugin. I'm doing the extraction using the <code>filter_parser</code> plugin using a <code>json</code> parser.</p>
  
  <pre><code>    &lt;source&gt;
        @type tail
        tag proxy.*
        ...
        read_from_head true
        &lt;parse&gt;
         @type regexp
         expression \[proxy\]\[(?&lt;type&gt;(record|replay))\](?&lt;log&gt;.*)
        &lt;/parse&gt;
      &lt;/source&gt;
  
      &lt;filter proxy.**&gt;
        @type parser
        key_name log
        &lt;parse&gt;
          @type json
        &lt;/parse&gt;
      &lt;/filter&gt;
  </code></pre>
  
  <p>Example log line:</p>
  
  <pre><code>[proxy][record]{"test":123}
  </code></pre>
  
  <p>This seems to produce a record as:</p>
  
  <pre><code>record={"type"=&gt;"record", "log"=&gt;"{\\\"test\\\":123}"}
  </code></pre>
  
  <p>When running the setup with the config, it looks like the value in the <code>log</code> regex group is being escaped (twice?); due to which the json parser in the filter section fails to parse it. </p>
  
  <p>I suspect it has something to do with how the <code>regexp</code> plugin and/or the <code>in_tail</code> has been written. It might be picking that <code>log</code> value as a string and escaping it before passing it on. </p>
  
  <p>Or is my regex missing something?</p>
  
  <p>Does anyone know why this is happening and what the solution might be? </p>