# FileBeat decode\_json\_fields processor max\_depth option not working

**URL:** https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/240948
**Category:** Beats
**Tags:** filebeat
**Created:** [July 13, 2020, 10:37am UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/240948 "2020-07-13T10:37:30Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Vitaliy\_Kravchenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliy_kravchenko/32/72027_2.png) [@Vitaliy\_Kravchenko](https://discuss.elastic.co/u/Vitaliy_Kravchenko)
#### Post date: [July 13, 2020, 10:37am UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/240948/1 "2020-07-13T10:37:30Z")

</div>

`decode_json_fields` -\> `max_depth` option not working or documentation misunderstanding.

To prevent creating tons of document fields in an Elasticsearch log index I want to control nested JSON parsing depth.

Filebeat version 7.8.0 (also tested on 6.8.10 and result is the same)

/tmp/filebeat.conf:

```auto
filebeat.inputs:
- type: log
  paths:
    - /tmp/filebeat.input

processors:
  - decode_json_fields:
      fields: ["message"]
      max_depth: 1
      target: "parsed"

output.console:
  pretty: true

```

/tmp/filebeat.input:

```auto
{"top": "top_value", "top_obj": {"level_1": "level_1_value", "level_1_obj": {"level_2": "level_2_value", "level_2_obj": {"level_3": "level_3_value"}}}}

```

Command:

```auto
filebeat -e -c /tmp/filebeat.conf

```

Result:

```auto
"parsed": {
  "top_obj": {
    "level_1_obj": {
      "level_2": "level_2_value",
      "level_2_obj": {
        "level_3": "level_3_value"
      }
    },
    "level_1": "level_1_value"
  },
  "top": "top_value"
}

```

Expected result:

```auto
"parsed": {
  "top_obj": {
    "level_1_obj": "{\"level_2\": \"level_2_value\", \"level_2_obj\": {\"level_3\": \"level_3_value\"}}",
    "level_1": "level_1_value"
  },
  "top": "top_value"
}

```

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [July 13, 2020, 11:53am UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/240948/2 "2020-07-13T11:53:59Z")

</div>

Thank you for reporting this! I was able to reproduce this.

Could you please open a Github issue reporting this potential bug?

C.

---

<div class="post-metadata">

### Author: ![Vitaliy\_Kravchenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliy_kravchenko/32/72027_2.png) [@Vitaliy\_Kravchenko](https://discuss.elastic.co/u/Vitaliy_Kravchenko)
#### Post date: [July 13, 2020, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/240948/3 "2020-07-13T12:14:44Z")

</div>

Thank you!

Related GitHub Issue: [https://github.com/elastic/beats/issues/19830](https://github.com/elastic/beats/issues/19830)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 10, 2020, 2:14pm UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/240948/4 "2020-08-10T14:14:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
