Good afternoon, we are configuring our elastic search stack and struggling with getting the message inside elastic search to reflect the format we desire.
We have php logs going to standard out, and the message is correct when we view the log in standard out. However, when we view that same log in elastic search via the API, the json is escaped.
We are pretty sure that the answer lies in the filebeat config, and we are using a decode_json_fields processor. But it is not making a significant difference. Could someone give us a little guidance on how to remove those escape characters?
Thanks.