Target field in ndjson

Elastic Stack Beats
1

Hi!

I have a log file with json records like

{
  "request": {
    "foo": "bar"
  },
  "response": {
    "foo": "bar"
  }
}

and the following configuration for filebeat

- type: filestream
  paths:
    - /path/to/file
  tags: ["tags"]
  fields_under_root: true
  fields:
    field1: value1
  parsers:
    - ndjson:
        target: root
        overwrite_keys: true
        expand_keys: true

So I want to see the parsed fields like root.request.foo and root.response.foo but it doesn't works.

With target: "" it normally parse log records to request.foo and response.foo

Whats could be wrong?

2

Hi @ddoroshenko

did you try to add add_error_key: true configuration and check if you can see any errors?
do you actually have root field? what will happen if you change the target field to not yet existing one?

3

did you try to add add_error_key: true configuration and check if you can see any errors?

no, I'll try it

do you actually have root field?

no, I have not.

4

I'm very sorry
It was simpy inattention. I had target at the wrong level

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.