i have this log : [{"date":1747652405.197626,"time...

Below is a practical, minimal-to-begin-with Fluent Bit pipeline that does what you asked:

• parses the whole record as JSON ( level 1 )
• “dives” into HttpContext ( level 2 ) and then into HttpContext.Request → Headers ( level 3 )
• lifts every key it finds there back up to the top so the fields are individually addressable downstream (Elasticsearch, Loki, Splunk, etc.).

ini
########################################
# 1. INPUT – read the file
########################################
[INPUT]
    Name        tail
    Path        /var/log/vendor/api.log    # <— your path
    Tag         vendorgw
    Parser      json_root                  # top-level JSON
    Refresh_Interval  5

########################################
# 2. PARSER – decode the line itself
########################################
[PARSER]
    Name        json_root
    Format      json
    Time_Key    time
    Time_Format %Y-%m-%dT%H:%M:%S.%LZ      # 2025-05-19T11:00:05.1972488Z
    #  ❯❯ If your file has one JSON array per line, add:
    #  JSON_Keys_On_Message    on

########################################
# 3a. FILTER – lift everything in “HttpContext”
########################################
[FILTER]
    Name        nest
    Match       vendorgw
    Operation   lift
    Nested_Under  HttpContext              # ⬆ makes Method, Scheme, … top-level

########################################
# 3b. FILTER – lift Request-level fields
########################################
[FILTER]
    Name        nest
    Match       vendorgw
    Operation   lift
    Nested_Under  Request                  # now Body, Protocol, Headers, …

########################################
# 3c. FILTER – lift individual HTTP headers
########################################
[FILTER]
    Name        nest
    Match       vendorgw
    Operation   lift
    Nested_Under  Headers                  # Host, User-Agent, X-Request-ID, …

########################################
# 4. (optional) FILTER – drop the now-empty
#    HttpContext / Request / Headers shells
########################################
[FILTER]
    Name        modify
    Match       vendorgw
    Remove_Key  HttpContext
    Remove_Key  Request
    Remove_Key  Headers

########################################
# 5. OUTPUT – wherever you need
########################################
[OUTPUT]
    Name        es
    Match       vendorgw
    Host        elasticsearch.example.local
    Port        9200
    Index       vendor-logs

How it works & why it satisfies “level 2 / level 3 nest”

Stage	What it does	Your example key path	Resulting key after lift
Parser	Turns each log line into a record map	HttpContext.Request.Headers.Host	still nested
nest #1	lift everything immediately under HttpContext	HttpContext.Method	Method
nest #2	lift everything under Request (which is already at top because of step #1)	Request.Headers	Headers
nest #3	lift everything under Headers	Headers.User-Agent	User_Agent

After those three passes, all the interesting bits (path, method, IPs, user-agent, trace ID, etc.) live side-by-side with the top-level fields such as level, message, EnvironmentName, making search, alerting and dashboards painless.

---

Tweaks you may want

1. Keep nesting instead of flattening
   If your backend understands dots as “real” objects (e.g., OpenSearch with dynamic templates), just skip the last two nest filters so HttpContext.Request.Headers.* stays grouped.

2. Only lift a subset
   Add Wildcard ^(Method|Path|IpAddress)$ (regex) to a nest filter to pull up only those keys.

3. Log lines wrapped in an array
   Some frameworks emit [ {...}, {...} ].
   Add JSON_Keys_On_Message on to the parser so Fluent Bit treats the array as one record.

4. Metrics exporter noise
   To drop Prometheus/Blackbox health-checks, insert a grep filter before the nest chain:

   ini
   [FILTER]
       Name  grep
       Match vendorgw
       Exclude  User_Agent ^Blackbox

---

That’s all you need: one parser + three nest filters. Once you see the structure in your destination, you can iteratively trim or rename fields with a modify filter, or convert timestamps to nanoseconds, etc.

Happy shipping!