# Ndjson parser doesn't expand keys if target is set

**URL:** <https://discuss.elastic.co/t/ndjson-parser-doesnt-expand-keys-if-target-is-set/334799>\
**Category:** Beats\
**Tags:** filebeat, libbeat\
**Created:** [May 31, 2023, 11:52am UTC](https://discuss.elastic.co/t/ndjson-parser-doesnt-expand-keys-if-target-is-set/334799 "2023-05-31T11:52:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon68795679](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@anon68795679](https://discuss.elastic.co/u/anon68795679)\
**Post date:** [May 31, 2023, 11:52am UTC](https://discuss.elastic.co/t/ndjson-parser-doesnt-expand-keys-if-target-is-set/334799/1 "2023-05-31T11:52:45Z")

</div>

Hi,

it seems that there is the same issue with the ndjson parser like in the decode\_json\_fields processor some time ago: [Expand fields in `decode_json_fields` if target is set by kvch · Pull Request #32010 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/32010)

dotted fields aren't expanded it the target option in ndjson parser is set. All works fine if the target option is missing.  
Seems to be this code position: [beats/json.go at main · elastic/beats · GitHub](https://github.com/elastic/beats/blob/main/libbeat/reader/readjson/json.go#L187)

Example Config:

```auto
- type: filestream
  id: my_dummy_log
  paths:
    - /tmp/my_dummy_log
  parsers:
    - ndjson:
        target: 'dummy'
        expand_keys: true

```

Example Log data

```auto
{ "my.test": 1 }

```

Expected event:

```auto
{ "dummy": { "my": { "test": 1 } } }

```

But got event:  
t:

```auto
{ "dummy": { "my.test": 1 } }

```

Tried with

```auto
- type: filestream
  id: my_dummy_log
  paths:
    - /tmp/my_dummy_log
  parsers:
    - ndjson:
        expand_keys: true

```

Then I get:

```auto
{ "my": { "test": 1 } }

```

It would be nice to get the old processor bug fix also for the ndjson parser.

Regards,  
Marcel

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [May 31, 2023, 12:50pm UTC](https://discuss.elastic.co/t/ndjson-parser-doesnt-expand-keys-if-target-is-set/334799/2 "2023-05-31T12:50:24Z")

</div>

Hi @anon68795679,

We really appreciate your research on this and for sharing the issue. It's really helpful! I don't see an active issue that fits this problem.

Do you mind raising a [GitHub bug issue](https://github.com/elastic/beats/issues/new/choose) on `@elastic/beats` for this one? Do DM me if you need help raising it.

Thanks again!

---

<div class="post-metadata">

**Author:** ![anon68795679](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@anon68795679](https://discuss.elastic.co/u/anon68795679)\
**Post date:** [May 31, 2023, 1:13pm UTC](https://discuss.elastic.co/t/ndjson-parser-doesnt-expand-keys-if-target-is-set/334799/3 "2023-05-31T13:13:05Z")

</div>

Done: [ndjson parser doesn't expand keys if target is set · Issue #35628 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/35628)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2023, 3:13pm UTC](https://discuss.elastic.co/t/ndjson-parser-doesnt-expand-keys-if-target-is-set/334799/4 "2023-06-28T15:13:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.