I have a filebeat configuration as follows:
filebeat.yml: |-
filebeat.autodiscover:
providers:
- type: kubernetes
hints.enabled: true
templates:
- condition:
equals:
kubernetes.namespace: default
config:
- type: docker
containers.ids:
- "${data.kubernetes.container.id}"
processors:
decode_json_fields:
fields: ["message"]
target: ""
process_array: false
max_depth: 10
overwrite_keys: false
add_kubernetes_metadata:
in_cluster: true
output.logstash:
enabled: true
ssl.enabled: true
hosts: ["logstash.chargepayments.io:8751"]
ssl.certificate_authorities: ["${path.config}/keys/ca.crt"]
ssl.certificate: "${path.config}/keys/client.crt"
ssl.key: "${path.config}/keys/client.key"
Which then sends my logs to logstash. I can see this logs in Kibana but the message is a JSON string (line 46):
How can I have this field be a JSON object?