Expand_keys doesn't work if target option is used in decode_json_fields beat processor

Elastic Stack Beats
1

In decode_json_fields processor, expanded notation works only if target is left to "".
In fact, in source code ( beats/decode_json_fields.go at master · elastic/beats · GitHub ) there is a clear if section:

		if target != "" {
			_, err = event.PutValue(target, output)
		} else {
			switch t := output.(type) {
			case map[string]interface{}:
				jsontransform.WriteJSONKeys(event, t, f.expandKeys, f.overwriteKeys, f.addErrorKey)
			default:
				errs = append(errs, "failed to add target to root")
			}
		}

Is there a reson for this?
I'd like to convert a json under a specific object (e.g. under the old json field), rename all relevant info into toplevel ECS structure, and then delete the object, so that I don't send any unnecessary info.
Thank you,
D.

2

It is a bug. Could you please open an issue on GH? Sign in to GitHub · GitHub

3

Issue opened: Expand_keys doesn’t work if target option is used in decode_json_fields beat processor · Issue #31712 · elastic/beats · GitHub
Thank you.

4

Thank you!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.