Hi! I'm using filebeat in my GKE cluster. All my logs messages are in json format. My surprise is that the message field is treated as a single field, and what I would like is for it to be treated as separate fields in order to have columns with the value key. Example (extract) of json log receiv…

processors: decode_json_fields: fields: ["message"] target: "" overwrite_keys: true Reference : Condition with decode_json_fields processor

Discuss the Elastic Stack

Filter the content of "message" as independent fields

Elastic Stack Beats

kumarabhi (Abhishek) September 23, 2019, 5:38pm 2

processors:

decode_json_fields:
fields: ["message"]
target: ""
overwrite_keys: true

Reference : Condition with decode_json_fields processor

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.