# What happens with my message field if I use decode\_json\_fields processor?

**URL:** https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279139
**Category:** Kibana
**Created:** [July 20, 2021, 9:10am UTC](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279139 "2021-07-20T09:10:05Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![testisnullus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/testisnullus/32/91816_2.png) [@testisnullus](https://discuss.elastic.co/u/testisnullus)
#### Post date: [July 20, 2021, 9:10am UTC](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279139/1 "2021-07-20T09:10:05Z")

</div>

Greatings all!  
I have the next message field:

```auto
message: {"app":"rbac","args":[],"commandTag":null,"fields.time":353859,"file":"adapter.go","func":"Log","level":"info","msg":"Exec","pid":28700,"sql":";","time":"2021-07-20T07:59:3

```

If I apply the next processor configuration in my filebeat.yaml what happens with my message field?  
Processor configuration:

```auto
- decode_json_fields:
          fields: ["message"]
          process_array: false
          target: ""
          overwrite_keys: true
          aadd_error_key: false

```

Kibana version: 7.7.1  
Filebeat version: 7.6.2

Thank you for your help!  
Danil

---

<div class="post-metadata">

### Author: ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)
#### Post date: [July 20, 2021, 11:02am UTC](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279139/2 "2021-07-20T11:02:51Z")

</div>

Hi there,

I think your question refers more to beats than kibana, try asking there: [Beats - Discuss the Elastic Stack](https://discuss.elastic.co/c/elastic-stack/beats/28)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 17, 2021, 11:03am UTC](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279139/3 "2021-08-17T11:03:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.