Fluentd doesn't parse json log from docker - json

Question

I have some problems parsing json logs that were received from docker container. I know this question is probably a duplicate but none of the solutions found, including the documentation (https://docs.fluentd.org/filter/parser), helped.
Now my fluentd.conf like this:
<source>
#type forward
port 24224
bind "0.0.0.0"
</source>
<match mylog>
#type opensearch
#log_level "info"
host "opensearch-node1"
port 9200
logstash_format true
logstash_dateformat "%Y%m%d"
logstash_prefix "mylog"
</match>
<filter **>
#type parser
key_name "log"
hash_value_field "log"
reserve_data true
<parse>
#type "json"
</parse>
</filter>
But it feels like the filter is not working because the log field does not change
Result in OpenSearch:
{
"_index": "mylog-20221024",
"_id": "93cECoQBW3_q0OULbk2_",
"_version": 1,
"_score": null,
"_source": {
"container_id": "47de762b4d113478ee125417abd9e6ec7d963aa0d77758fc92cf3a18b0d2ad86",
"container_name": "/mylog",
"source": "stdout",
"log": "{\"time\":\"2022-10-24T15:42:48.480757224+03:00\",\"id\":\"\",\"remote_ip\":\"10.73.133.144\",\"host\":\"localhost:80\",\"method\":\"GET\",\"uri\":\"/metrics\"}",
"#timestamp": "2022-10-24T12:42:48.000000000+00:00"
},
"fields": {
"#timestamp": [
"2022-10-24T12:42:48.000Z"
]
},
"sort": [
1666615368000
]
}
Expected:
{
"_index": "mylog-20221024",
"_id": "93cECoQBW3_q0OULbk2_",
"_version": 1,
"_score": null,
"_source": {
"container_id": "47de762b4d113478ee125417abd9e6ec7d963aa0d77758fc92cf3a18b0d2ad86",
"container_name": "/mylog",
"source": "stdout",
"log": "{\"time\":\"2022-10-24T15:42:48.480757224+03:00\",\"id\":\"\",\"remote_ip\":\"10.73.133.144\",\"host\":\"localhost:80\",\"method\":\"GET\",\"uri\":\"/metrics\"}",
"time": "2022-10-24T15:42:48.480757224+03:00",
"id":"",
"remote_ip":"10.73.133.144",
"host":"localhost:80",
"method":"GET",
"uri":"/metrics",
"#timestamp": "2022-10-24T12:42:48.000000000+00:00",
},
"fields": {
"#timestamp": [
"2022-10-24T12:42:48.000Z"
]
},
"sort": [
1666615368000
]
}
Thanks!

Answer 1

The solution to the problem turned out to be very simple. The <filter> should be placed before the <match>. Now my fluentd.conf like this:
<source>
#type forward
port 24224
bind "0.0.0.0"
</source>
<filter mylog**>
#type parser
format json
key_name log
reserve_data true
reserve_time true
inject_key_prefix logs.
</filter>
<match mylog>
#type opensearch
#log_level "info"
host "opensearch-node1"
port 9200
logstash_format true
logstash_dateformat "%Y%m%d"
logstash_prefix "mylog"
</match>