# Elastic agent filebeat processors' decode\_json\_fields error

**URL:** https://discuss.elastic.co/t/elastic-agent-filebeat-processors-decode-json-fields-error/313220
**Category:** Elastic Agent
**Tags:** filebeat
**Created:** [August 30, 2022, 7:06am UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-processors-decode-json-fields-error/313220 "2022-08-30T07:06:37Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![shshsh](https://avatars.discourse-cdn.com/v4/letter/s/3be4f8/32.png) [@shshsh](https://discuss.elastic.co/u/shshsh)
#### Post date: [August 30, 2022, 7:06am UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-processors-decode-json-fields-error/313220/1 "2022-08-30T07:06:37Z")

</div>

Hi,

1. I am testing out elasticsearch logging via agent enrolled in fleet
2. custom logs integration with logpath /var/lib/docker/containers/_/_-json.log
3. testing out k8s container logs with similar setup
4. setup that functioned properly in 8.3.2 stops working on 8.4.0

custom configurations:

```auto
processors:
  - decode_json_fields:
      fields: ["message"]
      process_array: true
      max_depth: 3
      target: "messages"
      overwrite_keys: false
      add_error_key: true

```

I'm trying to decode a multi level json field via the configuration above, which worked fine in 8.3.2, but spits out the following error in 8.4.0.

Preview of field's value: '{filename=hello, func=hello.py, level=INFO, line=16, message={res\_body={"detail": "user \"77777\" not found."}, path=/api/v1.0/hello/, method=GET, req\_body=null, req\_params=b'name=77777', latency=1, host=[-.-.-.-, port], client=[-.-.-.-, port], status=400}, loggerName=name, timestamp=2022-08-30T06:41:16.855Z}'","caused\_by":{"type":"illegal\_state\_exception","reason":"Can't get text on a START\_OBJECT at 1:514"}}, dropping event!

example message field:  
{"log":"{"timestamp": "2022-08-30T06:42:25.511Z", "level": "INFO", "loggerName": "name", "filename": "hello", "line": 16, "func": "hello.py", "message": "{\"host\": [\"ip\_adr\", \"port\"], \"path\": \"/api/v1.0/hello/\", \"client\": [\"ip\_addr\", \"port\"], \"method\": \"GET\", \"status\": 400, \"req\_body\": null, \"req\_params\": \"b'name=77777'\", \"res\_body\": \"{\\\"detail\\\": \\\"user \\\\\\\"77777\\\\\\\" not found.\\\"}\", \"latency\": 1}"}\n","stream":"stderr","time":"2022-08-30T06:42:25.511614485Z"}

decode\_json\_fields works if max\_depth is 1, but stops working from 2. Using pipeline to decode the field still works fortunately, but I'm trying to reduce the elasticsearch node's performance hit minimal via filebeat's processors. I have tried using a different index to no avail. Any idea why this processor fails after the upgrade?

thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 27, 2022, 7:06am UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-processors-decode-json-fields-error/313220/2 "2022-09-27T07:06:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.