Filebeat 6.3.1 UDP + Json

Elastic Stack Beats
2

I see, the issue here is some confusion over the decode_json_fields option. That option specifies what the source field is that you want to decode. If you look at the output you posted above, the JSON is all in the message field. You'll need to use a config like:

filebeat.prospectors:
- type: udp
  max_message_size: 10KiB
  host: "localhost:7070"
  enabled: true
  processors:
  - add_locale: ~
  - add_host_metadata: ~
  - decode_json_fields:
      fields: ["message"]

output.console:
  pretty: true

logging.level: debug

That will decode the fields. You may also want to rename those fields once they're decoded.