Cluster Logging to Elasticsearch target with systemd underlying OS

Changing docker’s log driver from journald to json-file resolved my issue.

Just a heads up for other folks in the same situation, the current docker package in CentOS’s extras repository configures the log driver in /etc/sysconfig/docker. So configuring it in /etc/docker/daemon.json won’t work. You’ll just need to remove ‘–log-driver =journald’ from /etc/sysconfig/docker and restart docker.service.