# How to avoid creating the dynamic fields in Kibana upon json decode of a specific field in the filebeat processor?

**URL:** https://discuss.elastic.co/t/how-to-avoid-creating-the-dynamic-fields-in-kibana-upon-json-decode-of-a-specific-field-in-the-filebeat-processor/198158
**Category:** Beats
**Tags:** filebeat
**Created:** [September 5, 2019, 6:09am UTC](https://discuss.elastic.co/t/how-to-avoid-creating-the-dynamic-fields-in-kibana-upon-json-decode-of-a-specific-field-in-the-filebeat-processor/198158 "2019-09-05T06:09:42Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![rahul\_mohan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_mohan/32/53538_2.png) [@rahul\_mohan](https://discuss.elastic.co/u/rahul_mohan)
#### Post date: [September 5, 2019, 6:09am UTC](https://discuss.elastic.co/t/how-to-avoid-creating-the-dynamic-fields-in-kibana-upon-json-decode-of-a-specific-field-in-the-filebeat-processor/198158/1 "2019-09-05T06:09:42Z")

</div>

Hello,

I have an application deployed on IBM K8. It logs on the console. Logs range from simple json to nested json.

I use the custom template with fields.yml for the fields in the ES-Kibana.

Here is my filebeat prospector:

.....

- type: log  
paths:  
- /var/lib/docker/containers/_/_.log  
- /var/data/kubeletlogs/_/_/\*.log#  
json.message\_key: log  
#json.keys\_under\_root: true  
logging.files.keepfiles: 7  
#fields\_under\_root: true  
....

Here is my filebeat.yaml config

.....  
processors:  
- add\_kubernetes\_metadata:  
in\_cluster: true  
- decode\_json\_fields:  
fields: ["message"]  
process\_array: true  
max\_depth: 1

output.elasticsearch:  
enabled: true  
hosts: ["host"]  
protocol: "https"  
username: "username"  
password: "password"  
#ssl.enabled: true  
ssl.certificate\_authorities: ["/usr/share/filebeat/certificate.pem"]  
#ssl.certificate: "/usr/share/filebeat/certificate.pem"  
index: "my-log-%{+YYYY.MM.dd}"  
setup.template:  
name: "my-log"  
pattern: "my-log-\*"  
overwrite: false  
enabled: false  
.....

The default fields.yml that comes with filebeat, has a field "message" of type text.  
It is this field which has my stringified json log.

Now, if i disable the decode json part in the processor, i get my logs under the message field in the stringified way.

But, if I apply the decode json for the field "message", it decodes it properly, but it creates all the dynamics fields from the decoded json.

How can i contain the decoded json as part of "message" field only, and not allow it to be split and hv the fields created for them.

Also, when i do the json decode on "message" i get mapper issues, saying that the message if of type "text" but upon decode, it gets an object.

Can i change the type of the "message" field as "object" instead of "text". Will this resolve my mapper issue?  
Can there be a way to change the type of the field in the fields.yml from "text" to "object" through filebeats.yml config?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 3, 2019, 6:09am UTC](https://discuss.elastic.co/t/how-to-avoid-creating-the-dynamic-fields-in-kibana-upon-json-decode-of-a-specific-field-in-the-filebeat-processor/198158/2 "2019-10-03T06:09:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.