[PARSER]
    Name        docker
    Format      json
    Time_Key    time
    Time_Format %Y-%m-%dT%H:%M:%S.%L
    Time_Keep   On

    # next bit is useful when the logs from the function itself are in json
    # Command      |  Decoder | Field | Optional Action
    # =============|==================|=================
    #Decode_Field_As   escaped    log