The configuration that I suggested for the example you gave had json.message_key: msg
because the JSON being parsed has a msg
field. It does not have a message
field and that's why there is an error.
The json.message
configuration option specifies what key to apply filtering and mutliline to. The configuration setting isn't required per the documentation.