Filebeat json decode dynamic target uses kubernetes pod name


is it possible to use a dynamic target in the decode_json_fields processor?

I would like to have a target as follows:

  • decode_json_fields:
    fields: ["message"]
    process_array: false
    max_depth: 1
    target: "" -> message holds a json string which is decoded an put behind the target.

pmsg -> is a fixed string. -> has the kubernetes pod name where the message is coming from -> that name changes depending on the pod name.

Thanks for your help

Hi @juka,

I think there is no way to do that with the decode_json_fields. But something you could do is using the rename processor to rename after decoding.

Would that help in this case?

Best regards