# Expand\_keys doesn't work if target option is used in decode\_json\_fields beat processor

**URL:** <https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 20, 2022, 10:16am UTC](https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276 "2022-05-20T10:16:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![iorfix](https://avatars.discourse-cdn.com/v4/letter/i/9fc348/32.png) [@iorfix](https://discuss.elastic.co/u/iorfix)\
**Post date:** [May 20, 2022, 10:16am UTC](https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276/1 "2022-05-20T10:16:35Z")

</div>

In _decode\_json\_fields_ processor, expanded notation works only if target is left to "".  
In fact, in source code ( [beats/decode\_json\_fields.go at master · elastic/beats · GitHub](https://github.com/elastic/beats/blob/master/libbeat/processors/actions/decode_json_fields.go#L150) ) there is a clear _if_ section:

```auto
		if target != "" {
			_, err = event.PutValue(target, output)
		} else {
			switch t := output.(type) {
			case map[string]interface{}:
				jsontransform.WriteJSONKeys(event, t, f.expandKeys, f.overwriteKeys, f.addErrorKey)
			default:
				errs = append(errs, "failed to add target to root")
			}
		}

```

Is there a reson for this?  
I'd like to convert a json under a specific object (e.g. under the _old_ _json_ field), rename all relevant info into toplevel ECS structure, and then delete the object, so that I don't send any unnecessary info.  
Thank you,  
D.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [May 23, 2022, 2:46pm UTC](https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276/2 "2022-05-23T14:46:26Z")

</div>

It is a bug. Could you please open an issue on GH? [Sign in to GitHub · GitHub](https://github.com/elastic/beats/issues/new?assignees=&labels=&template=bug-report.md)

---

<div class="post-metadata">

**Author:** ![iorfix](https://avatars.discourse-cdn.com/v4/letter/i/9fc348/32.png) [@iorfix](https://discuss.elastic.co/u/iorfix)\
**Post date:** [May 23, 2022, 3:36pm UTC](https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276/3 "2022-05-23T15:36:27Z")

</div>

> [@iorfix](#):
>
> In _decode\_json\_fields_ processor, expanded notation works only if target is left to "".  
> In fact, in source code ( [beats/decode\_json\_fields.go at master · elastic/beats · GitHub](https://github.com/elastic/beats/blob/master/libbeat/processors/actions/decode_json_fields.go#L150) ) there is a clear _if_ section:

Issue opened: [Expand\_keys doesn’t work if target option is used in decode\_json\_fields beat processor · Issue #31712 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/31712)  
Thank you.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [May 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276/4 "2022-05-24T10:35:08Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2022, 12:35pm UTC](https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276/5 "2022-06-21T12:35:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.