# Filebeat 6.3.1 UDP + Json

**URL:** https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624
**Category:** Beats
**Tags:** filebeat
**Created:** [July 18, 2018, 9:09pm UTC](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624 "2018-07-18T21:09:33Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [July 18, 2018, 9:25pm UTC](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624/2 "2018-07-18T21:25:35Z")

</div>

I see, the issue here is some confusion over the `decode_json_fields` option. That option specifies what the _source_ field is that you want to decode. If you look at the output you posted above, the JSON is all in the `message` field. You'll need to use a config like:

```auto
filebeat.prospectors:
- type: udp
  max_message_size: 10KiB
  host: "localhost:7070"
  enabled: true
  processors:
  - add_locale: ~
  - add_host_metadata: ~
  - decode_json_fields:
      fields: ["message"]

output.console:
  pretty: true

logging.level: debug

```

That will decode the fields. You may also want to [rename](https://www.elastic.co/guide/en/beats/filebeat/6.x/rename-fields.html) those fields once they're decoded.

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624)._