Parse json from inside message

Elastic Stack Beats
,
2

Hmmm, what you have should work.

Could you try enclosing the label keys in double quotes, like so:

labels:
  "co.elastic.logs/json.keys_under_root": true
  "co.elastic.logs/json.overwrite_keys": true
  "co.elastic.logs/json.add_error_key": true
  "co.elastic.logs/json.expand_keys": true

If that doesn't work, could you try using the array form for the labels like so:

labels:
  - "co.elastic.logs/json.keys_under_root=true"
  - "co.elastic.logs/json.overwrite_keys=true"
  - "co.elastic.logs/json.add_error_key=true"
  - "co.elastic.logs/json.expand_keys=true"

Thanks,

Shaunak