ERROR instance/beat.go:971 Exiting: error initializing processors: unexpected expand_keys option in processors.1.decode_json_fields

[NiamhAsura (Niamh)]

Hi,

I am trying to use the expand_keys option as specified in the configuration for decode_json_fields. I am getting the following error:

ERROR instance/beat.go:971 Exiting: error initializing processors: unexpected expand_keys option in processors.1.decode_json_fields

When using the following configuration:

processors:
      - add_host_metadata:
          when.not.contains.tags: forwarded
      - decode_json_fields:
          fields: ["message"]
          process_array: true
          max_depth: 100
          target: "dEvent"
          expand_keys: true
          add_error_key: true

However it works fine when removing the expand_keys: true line.

Thanks

[Marius_Iversen]

Hello @NiamhAsura , which version are you running, as it might be that it is not supported on your version?

I believe for example that this feature is not on 6.x

[NiamhAsura (Niamh)]

Hi @Marius_Iversen thanks for the response.

I did double check this as I wasn't previously on the right version, but even after upgrading to 7.12.1, the issue remains. I did confirm it again by running filebeat version

[Marius_Iversen]

Could you try to run a filebeat test config ?

If it was initially on the older version, you might still be somewhat running the old one, if both are installed at the same time? I don't know if this was installed through deb/rpm or not, as the format should be fine if you are on the right version.

[conzyor34]

Hi @Marius_Iversen I have repro'd OPs issue, and a Google search lead me here. I installed filebeat with .deb and it is the only copy on the system.

# filebeat version
filebeat version 7.12.1 (amd64), libbeat 7.12.1 [651a2ad1225f3d4420a22eba847de385b71f711d built 2021-04-20 20:58:32 +0000 UTC]
# filebeat test config
Config OK

The config looks like:

processors:
  - decode_json_fields:
      fields: ["message"]
      expand_keys: true
      target: ""

The result is the same as OP:

# filebeat
Exiting: Failed to start crawler: starting input failed: Error while initializing input: unexpected expand_keys option in filebeat.inputs.0.processors.0.decode_json_fields

Let me know what you think. Thanks!