Filebeat json decode dynamic target uses kubernetes pod name

Hello,

is it possible to use a dynamic target in the decode_json_fields processor?
https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html

I would like to have a target as follows:
processors:

  • decode_json_fields:
    fields: ["message"]
    process_array: false
    max_depth: 1
    target: "pmsg.kubernetes.pod.name"

pmsg.kubernetes.pod.name -> message holds a json string which is decoded an put behind the target.

pmsg -> is a fixed string.
kubernetes.pod.name -> has the kubernetes pod name where the message is coming from -> that name changes depending on the pod name.

Thanks for your help

Hi @juka,

I think there is no way to do that with the decode_json_fields. But something you could do is using the rename processor to rename after decoding.

Would that help in this case?

Best regards