ERROR instance/beat.go:971 Exiting: error initializing processors: unexpected expand_keys option in processors.1.decode_json_fields

Hi,

I am trying to use the expand_keys option as specified in the configuration for decode_json_fields. I am getting the following error:

ERROR instance/beat.go:971 Exiting: error initializing processors: unexpected expand_keys option in processors.1.decode_json_fields

When using the following configuration:

processors:
      - add_host_metadata:
          when.not.contains.tags: forwarded
      - decode_json_fields:
          fields: ["message"]
          process_array: true
          max_depth: 100
          target: "dEvent"
          expand_keys: true
          add_error_key: true

However it works fine when removing the expand_keys: true line.

Thanks

Hello @NiamhAsura , which version are you running, as it might be that it is not supported on your version?

I believe for example that this feature is not on 6.x

Hi @Marius_Iversen thanks for the response.

I did double check this as I wasn't previously on the right version, but even after upgrading to 7.12.1, the issue remains. I did confirm it again by running filebeat version

Could you try to run a filebeat test config ?

If it was initially on the older version, you might still be somewhat running the old one, if both are installed at the same time? I don't know if this was installed through deb/rpm or not, as the format should be fine if you are on the right version.