title: Parse nginx ingress logs in fluentd
body: <p>I'd like to parse ingress nginx logs using fluentd in Kubernetes. That was quite easy in Logstash, but I'm confused regarding fluentd syntax.</p>
  
  <p>Right now I have the following rules:</p>
  
  <pre><code>&lt;source&gt;
    type tail
    path /var/log/containers/*.log
    pos_file /var/log/es-containers.log.pos
    time_format %Y-%m-%dT%H:%M:%S.%NZ
    tag kubernetes.*
    format json
    read_from_head true
    keep_time_key true
  &lt;/source&gt;
  
  &lt;filter kubernetes.**&gt;
    type kubernetes_metadata
  &lt;/filter&gt;
  </code></pre>
  
  <p>And as a result I get this log but it is unparsed:</p>
  
  <pre><code>127.0.0.1 - [127.0.0.1] - user [27/Sep/2016:18:35:23 +0000] "POST /elasticsearch/_msearch?timeout=0&amp;ignore_unavailable=true&amp;preference=1475000747571 HTTP/2.0" 200 37593 "http://localhost/app/kibana" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Centos Chromium/52.0.2743.116 Chrome/52.0.2743.116 Safari/537.36" 951 0.408 10.64.92.20:5601 37377 0.407 200
  </code></pre>
  
  <p>I'd like to apply filter rules to be able to search by IP address, HTTP method, etc in Kibana. How can I implement that?</p>