I am trying to use the expand_keys option as specified in the configuration for decode_json_fields. I am getting the following error:
ERROR instance/beat.go:971 Exiting: error initializing processors: unexpected expand_keys option in processors.1.decode_json_fields
When using the following configuration:
However it works fine when removing the expand_keys: true line.
Hello @NiamhAsura , which version are you running, as it might be that it is not supported on your version?
I believe for example that this feature is not on 6.x
Hi @Marius_Iversen thanks for the response.
I did double check this as I wasn't previously on the right version, but even after upgrading to 7.12.1, the issue remains. I did confirm it again by running
Could you try to run a
filebeat test config ?
If it was initially on the older version, you might still be somewhat running the old one, if both are installed at the same time? I don't know if this was installed through deb/rpm or not, as the format should be fine if you are on the right version.
Hi @Marius_Iversen I have repro'd OPs issue, and a Google search lead me here. I installed filebeat with .deb and it is the only copy on the system.
# filebeat version
filebeat version 7.12.1 (amd64), libbeat 7.12.1 [651a2ad1225f3d4420a22eba847de385b71f711d built 2021-04-20 20:58:32 +0000 UTC]
# filebeat test config
The config looks like:
The result is the same as OP:
Exiting: Failed to start crawler: starting input failed: Error while initializing input: unexpected expand_keys option in filebeat.inputs.0.processors.0.decode_json_fields
Let me know what you think. Thanks!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.