# Docker json-file: moby v28.0.0 daemon/logger/jsonfilelog/jsonlog/jsonlogbytes.go writes {"log":…,"stream":…,"attrs":…,"time":…}, the line with its newline, time as RFC3339Nano
# CRI: containerd v2.4.2 internal/cri/io/logger.go writes time.RFC3339Nano, the stream, the tag P (partial) or F (full) and the content, space separated; kubernetes v1.37.1 cri-api constants.go
# docker logs -t: moby v28.0.0 api/server/httputils/write_log_stream.go prefixes jsonmessage.RFC3339NanoFixed and a space; kubectl logs --timestamps: kubernetes v1.37.1 cri-client logs.go timeFormatOut = RFC3339NanoFixed
# The stream is where the program wrote, not a level; the line it carries is read again, and its own header gives the level
# constructed {"log":"hello world\n","stream":"stdout","time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "container", "level": "info", "leveled": false, "name": "", "message": "hello world", "prefixed": true}
# constructed {"log":"boom\n","stream":"stderr","time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "container", "level": "info", "leveled": false, "name": "", "message": "boom"}
# constructed {"log":"[2026-10-21T14:03:01Z INFO  app::main] ready\n","stream":"stderr","time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "container", "level": "info", "leveled": true, "name": "app::main", "message": "ready"}
# constructed {"log":"2026/10/21 14:03:01 WARN disk low\n","stream":"stdout","time":"2026-10-21T14:03:01.1234567Z"} ⇒ {"rule": "container", "level": "warn", "name": "", "message": "disk low"}
# constructed {"log":"level=error msg=\"pump stalled\" rpm=0\n","stream":"stdout","time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "container+kv", "level": "error", "name": "", "message": "pump stalled"}
# constructed {"log":"ready\n","stream":"stdout","attrs":{"tag":"pump"},"time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "container", "level": "info", "leveled": false, "name": "", "message": "ready"}
# constructed {"log":"a line cut at 16K","stream":"stdout","time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "container", "level": "info", "name": "", "message": "a line cut at 16K"}
# constructed {"log":"ERROR: crlf line\r\n","stream":"stderr","time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "container", "level": "error", "name": "", "message": "crlf line"}
# constructed 2026-10-21T14:03:01.123456789Z stdout F hello world ⇒ {"rule": "container", "level": "info", "leveled": false, "name": "", "message": "hello world"}
# constructed 2026-10-21T14:03:01.123456789Z stderr F boom ⇒ {"rule": "container", "level": "info", "leveled": false, "name": "", "message": "boom"}
# a partial line and its rest are read each on their own
# constructed 2026-10-21T14:03:01.123456789Z stdout P ERROR: a partial line that conti ⇒ {"rule": "container", "level": "error", "name": "", "message": "a partial line that conti"}
# constructed 2026-10-21T14:03:01.123456789Z stdout F nues ⇒ {"rule": "container", "level": "info", "leveled": false, "name": "", "message": "nues"}
# constructed 2026-10-21T14:03:01.5Z stdout F RFC3339Nano drops trailing zeros ⇒ {"rule": "container", "level": "info", "name": "", "message": "RFC3339Nano drops trailing zeros"}
# constructed 2026-10-21T14:03:01Z stdout F whole second ⇒ {"rule": "container", "level": "info", "name": "", "message": "whole second"}
# constructed 2026-10-21T07:03:01.123456789-07:00 stdout F local zone offset ⇒ {"rule": "container", "level": "info", "name": "", "message": "local zone offset"}
# constructed 2026-10-21T14:03:01.123456789Z stdout F {"level":"info","msg":"x","logger":"app"} ⇒ {"rule": "container", "level": "info", "leveled": true, "name": "app", "message": "x"}
# constructed 2026-10-21T14:03:01.123456789Z stderr F [00:00:01.000,000] <wrn> main: low battery ⇒ {"rule": "container", "level": "warn", "name": "main", "device_ns": 1000000000, "message": "main: low battery"}
# constructed 2026-10-21T14:03:01.123456789Z stdout F:x a tag after the first ⇒ {"rule": "container", "level": "info", "name": "", "message": "a tag after the first"}
# constructed 2026-10-21T14:03:01.123456789Z hello world ⇒ {"rule": "container", "level": "info", "leveled": false, "name": "", "message": "hello world"}
# constructed 2026-10-21T14:03:01.000000000Z whole second kubectl ⇒ {"rule": "container", "level": "info", "name": "", "message": "whole second kubectl"}
# constructed 2026-10-21T14:03:01.123456789Z 2026/10/21 14:03:01 WARN disk low ⇒ {"rule": "container", "level": "warn", "name": "", "message": "disk low"}
# constructed 2026-10-21T14:03:01.123456789Z level=error msg="disk full" ⇒ {"rule": "container", "level": "error", "name": "", "message": "disk full"}
# constructed 2026-10-21T14:03:01.123456789+02:00 {"level":"warn","msg":"slow"} ⇒ {"rule": "container", "level": "warn", "name": "", "message": "slow"}
# a level word right after the stamp is a configured layout
# constructed 2026-10-21T14:03:01.123456789Z ERROR: x ⇒ {"rule": "layout", "level": "error", "message": "x"}
# constructed 2026-10-21T14:03:01.123456789Z [2026-10-21T14:03:01Z ERROR app::main] failed ⇒ {"rule": "container", "level": "error", "name": "app::main", "message": "failed"}
# no other stream, tag or stamp
# constructed 2026-10-21T14:03:01.123Z stdout X not a tag ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01.123Z stdout X not a tag"}
# constructed 2026-10-21T14:03:01.123Z stdin F not a stream ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01.123Z stdin F not a stream"}
# constructed 2026-10-21T14:03:01.123456Z hello six digits are not RFC3339NanoFixed ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01.123456Z hello six digits are not RFC3339NanoFixed"}
# constructed 2026-10-21T14:03:01.123456789 hello no zone ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01.123456789 hello no zone"}
# constructed 2026-10-21 14:03:01.123456789Z stdout F a space in the stamp ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21 14:03:01.123456789Z stdout F a space in the stamp"}
# constructed {"log":42,"stream":"stdout","time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "{\"log\":42,\"stream\":\"stdout\",\"time\":\"2026-10-21T14:03:01.123456789Z\"}"}
# constructed {"stream":"stdout","log":"order","time":"2026-10-21T14:03:01.123456789Z"} ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "{\"stream\":\"stdout\",\"log\":\"order\",\"time\":\"2026-10-21T14:03:01.123456789Z\"}"}
# constructed {"log":"cut ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "{\"log\":\"cut"}
# constructed {"level":"info","msg":"a JSON log line"} ⇒ {"rule": "json", "level": "info", "message": "a JSON log line"}
# constructed {"log":"x\n","stream":"stdout","time":"2026-10-21T14:03:01.123456789Z","level":"error"} ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "{\"log\":\"x\\n\",\"stream\":\"stdout\",\"time\":\"2026-10-21T14:03:01.123456789Z\",\"level\":\"error\"}"}
