# ERROR instance/beat.go:971 Exiting: error initializing processors: unexpected expand\_keys option in processors.1.decode\_json\_fields

**URL:** <https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 3, 2021, 1:10pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986 "2021-05-03T13:10:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![NiamhAsura](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niamhasura/32/88138_2.png) [@NiamhAsura](https://discuss.elastic.co/u/NiamhAsura)\
**Post date:** [May 3, 2021, 1:10pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986/1 "2021-05-03T13:10:48Z")

</div>

Hi,

I am trying to use the expand\_keys option as specified in the configuration for decode\_json\_fields. I am getting the following error:

` ERROR instance/beat.go:971 Exiting: error initializing processors: unexpected expand_keys option in processors.1.decode_json_fields`

When using the following configuration:

```auto
processors:
      - add_host_metadata:
          when.not.contains.tags: forwarded
      - decode_json_fields:
          fields: ["message"]
          process_array: true
          max_depth: 100
          target: "dEvent"
          expand_keys: true
          add_error_key: true

```

However it works fine when removing the expand\_keys: true line.

Thanks

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [May 3, 2021, 2:26pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986/2 "2021-05-03T14:26:21Z")

</div>

Hello @NiamhAsura , which version are you running, as it might be that it is not supported on your version?

I believe for example that this feature is not on 6.x

---

<div class="post-metadata">

**Author:** ![NiamhAsura](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niamhasura/32/88138_2.png) [@NiamhAsura](https://discuss.elastic.co/u/NiamhAsura)\
**Post date:** [May 3, 2021, 3:02pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986/3 "2021-05-03T15:02:20Z")

</div>

Hi @Marius_Iversen thanks for the response.

I did double check this as I wasn't previously on the right version, but even after upgrading to 7.12.1, the issue remains. I did confirm it again by running `filebeat version`

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [May 3, 2021, 3:19pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986/4 "2021-05-03T15:19:26Z")

</div>

Could you try to run a `filebeat test config` ?

If it was initially on the older version, you might still be somewhat running the old one, if both are installed at the same time? I don't know if this was installed through deb/rpm or not, as the format should be fine if you are on the right version.

---

<div class="post-metadata">

**Author:** ![conzyor34](https://avatars.discourse-cdn.com/v4/letter/c/8edcca/32.png) [@conzyor34](https://discuss.elastic.co/u/conzyor34)\
**Post date:** [May 22, 2021, 12:35am UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986/5 "2021-05-22T00:35:57Z")

</div>

Hi @Marius_Iversen I have repro'd OPs issue, and a Google search lead me here. I installed filebeat with .deb and it is the only copy on the system.

```
# filebeat version
filebeat version 7.12.1 (amd64), libbeat 7.12.1 [651a2ad1225f3d4420a22eba847de385b71f711d built 2021-04-20 20:58:32 +0000 UTC]
# filebeat test config
Config OK

```

The config looks like:

```
processors:
  - decode_json_fields:
      fields: ["message"]
      expand_keys: true
      target: ""

```

The result is the same as OP:

```
# filebeat
Exiting: Failed to start crawler: starting input failed: Error while initializing input: unexpected expand_keys option in filebeat.inputs.0.processors.0.decode_json_fields

```

Let me know what you think. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2021, 2:36am UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986/6 "2021-06-19T02:36:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.