# Why does the decode\_json\_fields processor not have a keys\_under\_root option?

**URL:** <https://discuss.elastic.co/t/why-does-the-decode-json-fields-processor-not-have-a-keys-under-root-option/175542>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 5, 2019, 8:43am UTC](https://discuss.elastic.co/t/why-does-the-decode-json-fields-processor-not-have-a-keys-under-root-option/175542 "2019-04-05T08:43:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![thola](https://avatars.discourse-cdn.com/v4/letter/t/3be4f8/32.png) [@thola](https://discuss.elastic.co/u/thola)\
**Post date:** [April 5, 2019, 8:43am UTC](https://discuss.elastic.co/t/why-does-the-decode-json-fields-processor-not-have-a-keys-under-root-option/175542/1 "2019-04-05T08:43:40Z")

</div>

I want to parse logs in the following format. But what confuses me is that i have to specify fields for the decode\_json\_fields processor under which to find json strings. But what if there is no outer field for the json? How would the following log to be parsed?

{  
"deploymentid": "3ae9ef41-ce1b-435a-abc9-4b441a4914bd",  
"level": "ERROR",  
"time": "2019-03-21T22:14:31.475878214Z",  
"api": {  
"name": "PutObject",  
"args": {  
"bucket": "test",  
"object": "issue"  
}  
},  
"remotehost": "127.0.0.1",  
"requestID": "158E190E7B258FDB",  
"userAgent": "Minio (linux; amd64) minio-go/v6.0.20 mc/2019-03-15T20:48:52Z",  
"error": {  
"message": "read tcp 172.16.1.105:9000-\>172.16.1.103:44678: read: connection reset by peer",  
"source": [  
"cmd/object-handlers.go:1073:cmd.objectAPIHandlers.PutObjectHandler()",  
"cmd/api-router.go:79:cmd.objectAPIHandlers.PutObjectHandler-fm()",  
"net/http/server.go:1964:http.HandlerFunc.ServeHTTP()"  
],  
"variables": {  
"peerAddress": "127.0.0.1:9000"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\
**Post date:** [April 5, 2019, 9:25am UTC](https://discuss.elastic.co/t/why-does-the-decode-json-fields-processor-not-have-a-keys-under-root-option/175542/2 "2019-04-05T09:25:37Z")

</div>

What decode json does is that it takes a field from the input and then parse its content.  
so if you have

```auto
{
  "msg": {your_content}
}

```

and configuration

```auto
{
    "fields": ["msg"],
    "process_array": false,
    "max_depth": 2,
    "target": "myfield",
}

```

it will take a msg field, decode the content and then create a `myfield` with parsed out json object.  
so something like this

```auto
{
   "msg": {your content},
   "myfield": {
      "deploymenyId": "3ae...",
      "level": "ERROR"
      "api": {
          ...
      }
   }
}

```

if your log entry is json itself maybe [this may come in handy](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-config-json)

---

<div class="post-metadata">

**Author:** ![thola](https://avatars.discourse-cdn.com/v4/letter/t/3be4f8/32.png) [@thola](https://discuss.elastic.co/u/thola)\
**Post date:** [April 5, 2019, 12:07pm UTC](https://discuss.elastic.co/t/why-does-the-decode-json-fields-processor-not-have-a-keys-under-root-option/175542/3 "2019-04-05T12:07:46Z")

</div>

Does that mean in my case, i have to combine the json and the multiline options in the prospector, like for example:

json.keys\_under\_root: true  
json.overwrite\_keys: true

multiline.pattern: '^{'  
multiline.negate: true  
multiline.match: after

processors:

- decode\_json\_fields:  
fields: ["api", "args", "error"]  
process\_array: true  
max\_depth: 3  
target: ""  
overwrite\_keys: true

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2019, 12:07pm UTC](https://discuss.elastic.co/t/why-does-the-decode-json-fields-processor-not-have-a-keys-under-root-option/175542/4 "2019-05-03T12:07:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.