Max depth in decode_json_fields not working

Elastic Stack Beats
1

I am trying to decode a json fields and try to limit the depth to 1.

My config as below:

        - decode_json_fields:
            fields: ["message"]
            process_array: true
            max_depth: 1
            target: "logger"
            overwrite_keys: true

And here is the original message field:

"message":"{\"timestamp\":\"2019-09-10T16:53:57.723998+08:00\",\"level\":\"INFO\",\"logger\":\"Rails\",\"message\":{\"method\":\"PUT\",\"path\":\"/api/workforces/profiles/159\",\"format\":\"json\",\"controller\":\"Hubble::Workforces::Api::V1::ProfilesController\",\"action\":\"update\",\"status\":200,\"duration\":117.48,\"view\":5.68,\"db\":23.94,\"params\":{\"name\":\"Green Earth Admin 01\"}},\"exception\":null,\"stacktrace\":null}",

Somehow, the params field are expanded and cause us a lot of problems since this field normally contains 2-3 level of nested json fields.

May I know what am I doing wrong and what can I do in this situation?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.