Condition with decode_json_fields processor

Elastic Stack Beats
10

Yes, it does. The conditions are implemented outside of the processors. The individual processors don't get a "say" in whether or not they respect the conditions.

Here's a simple example.

$ cat input.json 
{"log": "hello world!"}
{"log": "hello world!", "counter": 42}

$ cat filebeat.json.yml 
filebeat.prospectors:
- paths:
  - 'input.json'

processors:
- decode_json_fields:
    when.regexp.message: '^{'
    fields: ["message"]
    target: ""
    overwrite_keys: true

output.file:
  path: 'out'
  filename: filebeat.json

$ cat out/filebeat.json  | jq .
{
  "@timestamp": "2018-01-16T18:16:15.520Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.1.1"
  },
  "source": "/Users/akroh/Downloads/filebeat-6.1.1-darwin-x86_64/input.json",
  "offset": 24,
  "message": "{\"log\": \"hello world!\"}",
  "beat": {
    "version": "6.1.1",
    "name": "x",
    "hostname": "x"
  },
  "log": "hello world!"
}
{
  "@timestamp": "2018-01-16T18:16:15.521Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.1.1"
  },
  "beat": {
    "name": "x",
    "hostname": "x",
    "version": "6.1.1"
  },
  "log": "hello world!",
  "counter": 42,
  "source": "/Users/akroh/Downloads/filebeat-6.1.1-darwin-x86_64/input.json",
  "offset": 63,
  "message": "{\"log\": \"hello world!\", \"counter\": 42}"
}
1 Like