Parsing Json within a Json in Filebeat

[sheen2x (Sheen)]

Hi Elastic Support,

I'm using Filebeat 6.2.2 and we have a json log that looks like this:

{"Name":"John","Locations":["USA"],"Enabled":true,"Notes":"{"children":2,"details":[{"birthday":"1999-01-01t01:00:00.00000-04:00","childname":"Ringo"},{"birthday":"2001-03-01t01:00:00.00000-04:00","childname":"Michael"}]}"}

Pretty view:

{
"Name":"John",
"Locations":
[
"USA"
],
"Enabled":true,
"Notes": "{"children":2,"details":[{"birthday":"1999-01-01t01:00:00.00000-04:00","childname":"Ringo"},{"birthday":"2001-03-01t01:00:00.00000-04:00","childname":"Michael"}]}"
}

When I'm feeding it using Filebeat, it looks like this is Kibana:

Name: John
Locations: USA
Enabled: true
Notes.Children: 2
Notes.details: {
"birthday":"1999-01-01t01:00:00.00000-04:00",
"childname":"Ringo"
},
{ "birthday":"2001-03-01t01:00:00.00000-04:00",
"childname":"Michael"
}

Is there a way for it to be like this is Kibana by just using Filebeat?

Name: John
Locations: USA
Enabled: true
Notes.Children: 2
Notes.details.birthday1: 1999-01-01t01:00:00.00000-04:00
Notes.details.childname1: Ringo
Notes.details.birthday2: 2001-03-01t01:00:00.00000-04:00
Notes.details.childname2: Michael

Filebeat 6.2.2 config:

filebeat.prospectors:

• type: log
  enabled: true
  paths:

  • d:/Sheen/logs/Person.json
    fields_under_root: true
    json.keys_under_root: true

  processors:

  • decode_json_fields:
    fields: ["Notes"]
    output.console.pretty: true