How to fetch all the fields in decode_json_fields instead of specifying all the fields inside

Elastic Stack Beats
1

When i'm using decode_json_fields in Filebeat. I'm unable to specify all fields in a json

Below is my sample json

{"message":{"name": "Viswanath","cancel":1,"description":"Hey"},"level":"info"}

When i use the below configuration

processors:

  • decode_json_fields:
    fields: [message]
    process_array: false
    max_depth: 1
    target: ""
    overwrite_keys: false
    add_error_key: true

json value of "message" appears as string in elasticsearch index. (Logstash is not filtering any data, bypassing for now)

Is there any way to pass the data inside "message" key as json without name of the fields individually

2

Could you please share you full configuration formatted using </>?

3

Please remove max_depth: 1 and try

4

Found the issue. It is a bug associated with reserved word "message". If you use any other word the above config will work. Thanks for the help all...

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.