Hi! I'm using filebeat in my GKE cluster. All my logs messages are in json format. My surprise is that the message field is treated as a single field, and what I would like is for it to be treated as separate fields in order to have columns with the value key. Example (extract) of json log receiv…

processors: decode_json_fields: fields: ["message"] target: "" overwrite_keys: true Reference : Condition with decode_json_fields processor

Filter the content of "message" as independent fields

kumarabhi (Abhishek) September 23, 2019, 5:38pm 2

processors:

Topic		Replies	Views
Parse JSON in "message" field Beats filebeat	2	617	April 17, 2021
How can I extract a sub-field from a field and print it as a separate field in filebeat? Beats filebeat	10	315	June 23, 2023
Filebeat : Split the multiline json(array of json object) from message field to separate fields Beats filebeat	3	1528	February 9, 2022
Simplifying Filebeat JSON Output Format Beats filebeat	3	1046	July 5, 2017
Process specific dynamic array field from JSON file Beats filebeat	3	173	April 17, 2024