for the past week i was working on sending nginx custom json log to elasticsearch with replacing /hide sensitive data , one of the most painful problem with fluntd was problem in parsing json format , nginx was working correct as i expected but fluentd was not able to parsing some of access logs , i had tried many things but hell no , it was not working. in the end when i was going to give up i just tell myself to reading the parser code.