# Condition with decode\_json\_fields processor

**URL:** https://discuss.elastic.co/t/condition-with-decode-json-fields-processor/115093
**Category:** Beats
**Tags:** filebeat
**Created:** [January 11, 2018, 1:16pm UTC](https://discuss.elastic.co/t/condition-with-decode-json-fields-processor/115093 "2018-01-11T13:16:53Z")
**Posts on this page:** 1
**Showing post:** 10

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 16, 2018, 6:18pm UTC](https://discuss.elastic.co/t/condition-with-decode-json-fields-processor/115093/10 "2018-01-16T18:18:46Z")

</div>

> [@jochenchrist](#):
>
> Does the decode\_json\_fields processor respect the when condition?

Yes, it does. The conditions are implemented outside of the processors. The individual processors don't get a "say" in whether or not they respect the conditions.

Here's a simple example.

```auto
$ cat input.json 
{"log": "hello world!"}
{"log": "hello world!", "counter": 42}

```

```auto
$ cat filebeat.json.yml 
filebeat.prospectors:
- paths:
  - 'input.json'

processors:
- decode_json_fields:
    when.regexp.message: '^{'
    fields: ["message"]
    target: ""
    overwrite_keys: true

output.file:
  path: 'out'
  filename: filebeat.json

```

```auto
$ cat out/filebeat.json | jq .
{
  "@timestamp": "2018-01-16T18:16:15.520Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.1.1"
  },
  "source": "/Users/akroh/Downloads/filebeat-6.1.1-darwin-x86_64/input.json",
  "offset": 24,
  "message": "{\"log\": \"hello world!\"}",
  "beat": {
    "version": "6.1.1",
    "name": "x",
    "hostname": "x"
  },
  "log": "hello world!"
}
{
  "@timestamp": "2018-01-16T18:16:15.521Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.1.1"
  },
  "beat": {
    "name": "x",
    "hostname": "x",
    "version": "6.1.1"
  },
  "log": "hello world!",
  "counter": 42,
  "source": "/Users/akroh/Downloads/filebeat-6.1.1-darwin-x86_64/input.json",
  "offset": 63,
  "message": "{\"log\": \"hello world!\", \"counter\": 42}"
}

```

---

_[View the full topic](https://discuss.elastic.co/t/condition-with-decode-json-fields-processor/115093)._