decode_json_fields | Filebeat Reference [5.1]

» » »

decode_json_fieldsedit

The decode_json_fields processor decodes fields containing JSON strings and replaces the strings with valid JSON objects.

processors:
 - decode_json_fields:
     fields: ["field1", "field2", ...]
     process_array: false
     max_depth: 1

The decode_json_fields processor has the following configuration settings:

fields: The fields containing JSON strings to decode.
process_array: (Optional) A boolean that specifies whether to process arrays. The default is false.
max_depth: (Optional) The maximum parsing depth. The default is 1.