# Filebeat processor help

**URL:** <https://discuss.elastic.co/t/filebeat-processor-help/252516>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 19, 2020, 9:06am UTC](https://discuss.elastic.co/t/filebeat-processor-help/252516 "2020-10-19T09:06:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kay\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kay_khan/32/45028_2.png) [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\
**Post date:** [October 19, 2020, 9:06am UTC](https://discuss.elastic.co/t/filebeat-processor-help/252516/1 "2020-10-19T09:06:04Z")

</div>

Hey i need some help with filebeat processors. I want to decode\_json\_fields if the kubernetes.container.name is equal to 1 or more values.

```
   processors:
      - add_cloud_metadata:
      - add_host_metadata:
      - decode_json_fields:
          when:
            equals:
              kubernetes.container.name: "entity-extractor-api-prod"
          fields: ["message"]
          process_array: false
          max_depth: 10
          target: "log"
          overwrite_keys: true
          add_error_key: true

```

Is it possible to set an array here?

```
when:
  equals:
    kubernetes.container.name: ["app1", "app2"]
```

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [October 19, 2020, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-processor-help/252516/2 "2020-10-19T14:04:01Z")

</div>

Unfortunately, you cannot set an array. However, you can still accept the two names at the same time by using the `or` conditional:

```auto
when:
  or:
  - equals:
      kubernetes.container.name: "app1"
  - equals:
      kubernetes.container.name: "app2"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2020, 4:04pm UTC](https://discuss.elastic.co/t/filebeat-processor-help/252516/3 "2020-11-16T16:04:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.