What happens with my message field if I use decode_json_fields processor?

Elastic Stack Kibana
1

Hi all!
I have the next message field:

message: {"app":"rbac","args":[],"commandTag":null,"fields.time":353859,"file":"adapter.go","func":"Log","level":"info","msg":"Exec","pid":28700,"sql":";","time":"2021-07-20T07:59:3

If I apply the next processor configuration in my filebeat.yaml what happens with my message field?
Processor configuration:

- decode_json_fields:
          fields: ["message"]
          process_array: false
          target: ""
          overwrite_keys: true
          aadd_error_key: false

Kibana version: 7.7.1
Filebeat version: 7.6.2

Thank you for your help!
Danil

2

Hi there,

I think your question refers more to beats than kibana, try asking there: Beats - Discuss the Elastic Stack

3

Ok, thanks a lot!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.