Keys_under_root option in configuration


Just wonder how to put keys_under_root like filebeat do in my own beat? Is this supported or documented somewhere?

Can you provide more details about what you want to accomplish.


The filebeat has such option:

By default, the decoded JSON is placed under a "json" key in the output document. If you enable this setting, the keys are copied top level in the output document. The default is false.

What do I want to do?

I'm writing simple go program that processes documents that have a lot of string/double values and it's flat. I'm using elastic library to get the search results and every document data is stored under _source field and I have to parse the document every time. It would be easier to just get value by typing document.Field["key"].(string), and I was wonder from curiosity if how to accomplish putting keys under root in libbeat.

So if you are writing a Beat you are creating the output event that will be published. When you create the event you can populate it with the contents of the _source field.

I think you will have to unmarshal the _source field into a map[string]interface{}. Then once you have the _source field as an object you and create your event and populate it with the contents of _source.

source := // unmarshal _source JSON to map
myEvent := common.MapStr{
    "@timestamp": common.Time(time.Now()),
    "type": "mytype",
for k, v := range source {
    myEvent[k] = v

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.