# Custom Logs, fleet pre processor to keep on field as json itself

**URL:** <https://discuss.elastic.co/t/custom-logs-fleet-pre-processor-to-keep-on-field-as-json-itself/326327>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 23, 2023, 12:59pm UTC](https://discuss.elastic.co/t/custom-logs-fleet-pre-processor-to-keep-on-field-as-json-itself/326327 "2023-02-23T12:59:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![coderhs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coderhs/32/117657_2.png) [@coderhs](https://discuss.elastic.co/u/coderhs)\
**Post date:** [February 23, 2023, 12:59pm UTC](https://discuss.elastic.co/t/custom-logs-fleet-pre-processor-to-keep-on-field-as-json-itself/326327/1 "2023-02-23T12:59:47Z")

</div>

I have setup a self hosted elastic stack with kibana to track logs for a web application (ruby on rails). I am pushing the production logs to elastic using fleet. I am creating the log in JSON fromat from the application, and a typical log looks like below.

```json
{"method":"POST","path":<url>","format":"html","controller":"<class_name>","action":"<method>","status":200,"duration":71.21,"view":0.28,"db":0.0,"params":{<data>},"host":"<domain>","user_id":102,"time":"2023-02-23 12:52:31 +0000","ip":"<ip>"}

```

I use the following processor to decode the JSON

```yaml
- decode_json_fields:
    fields: ["message"]
    max_depth: 1
    target: "parsed_result"
    when:
        regexp:
            message: '\"path\":\"'   

```

The above code does its job by decoding the results and showing them as parsed\_result.controller, parsed\_result.user\_id, etc. But its also decoding the whole of the params field as well.

How can I prevent the decoding of params field, and just store the data inside params as a huge json/hash?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2023, 3:00pm UTC](https://discuss.elastic.co/t/custom-logs-fleet-pre-processor-to-keep-on-field-as-json-itself/326327/2 "2023-03-23T15:00:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.