In filebeat, what is the difference between json.keys_under_root and decode_json_fields

[john_eapen (je)]

I am confused about the difference between json.keys_under_root and decode_json_fields.

1. Are these overlapping options ? I need the fields to be under root.
2. I am getting these error and was wondering if decode_json_fields can help overcome it.
   //
   
   //"type":"mapper_parsing_exception","reason":"object mapping for [service] tried to parse field [service] as object, but found a concrete value"

[Michal_Pristas]

@john_eapen

decode_json_fields

the difference is that decode_json_field takes a string field and makes an object out of it
so when applied to key2 you will get from:

{
  "key1": 1,
  "key2": "{\"key3\": 3}"
}

to

{
  "key1": 1,
  "key2": {
      "key3": 3
  }
}

you can see that string in key2 was replaced by object

json.keys_under_root on the other hand moves them from json key
to the root so you will go from

{
    "type": "test_type",
    "json": {
        "type": "test",
        "text": "hello",
    }
}

to

{
    "type": "test_type",
    "text": "hello",
}

you can see type was not overwritten despite being under json key. if you want keys to be overwritten by what you have under json you should use json.overwrite_keys: true