How Can I Control JSON Parsing Depth?

Elastic Stack Beats
1

In Decode JSON fields | Filebeat Reference [7.12] | Elastic

max_depth
(Optional) The maximum parsing depth. A value of 1 will decode the JSON objects in fields 
indicated in fields, a value of 2 will also decode the objects embedded in the fields of these parsed 
documents. The default is 1.

So I have this config:

processors:
    - decode_json_fields:
          fields: ["message"]
          target: "json"
          process_array: false
          max_depth: 1
          add_error_key: true

However, all of json fields are parsed. e.g. json.data.response.payload.message. Now total number of fields has exceeded 1000.

How can I control the depth to reduce the number of fields?

2

Hm.. I'm not sure if there is such mechanism. Did you try to use the script processor?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.