Process json with multiple keys of same name via filebeat.yml

I am trying to process my json log to extract all the fields.

- decode_json_fields:
      fields: ["message"]
      target: ""
      process_array: false
      expand_keys: true
      overwrite_keys: false

Example of log:

  "sub" : "math",
  "sub" : "bio",
  "marks" : 23,
  "marks" : 45,
  "subID" : "math"

I am trying to upload these all fields either through dynamic renaming or through appending the value to array if needed

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.