Skip to content

Update decode_json_fields.asciidoc #25056

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bmorelli25 merged 7 commits into from
Apr 21, 2021
Merged

Update decode_json_fields.asciidoc #25056

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
fc15f7e
Update decode_json_fields.asciidoc
leahleahy Apr 13, 2021
7c356c4
Update libbeat/processors/actions/docs/decode_json_fields.asciidoc
leahleahy Apr 14, 2021
fae051d
Update libbeat/processors/actions/docs/decode_json_fields.asciidoc
leahleahy Apr 14, 2021
9bb2860
Update libbeat/processors/actions/docs/decode_json_fields.asciidoc
leahleahy Apr 14, 2021
c9cc5c1
Update decode_json_fields.asciidoc
leahleahy Apr 14, 2021
1a677fa
Update decode_json_fields.asciidoc
leahleahy Apr 14, 2021
b7b920a
Update libbeat/processors/actions/docs/decode_json_fields.asciidoc
bmorelli25 Apr 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions libbeat/processors/actions/docs/decode_json_fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,26 +23,26 @@ processors:
The `decode_json_fields` processor has the following configuration settings:

`fields`:: The fields containing JSON strings to decode.
`process_array`:: (Optional) A boolean that specifies whether to process
arrays. The default is false.
`max_depth`:: (Optional) The maximum parsing depth. A value of 1 will decode the
`process_array`:: (Optional) A Boolean that specifies whether to process
Comment thread
dedemorton marked this conversation as resolved.
Outdated
arrays. The default is `false`.
`max_depth`:: (Optional) The maximum parsing depth. A value of one will decode the
Comment thread
leahleahy marked this conversation as resolved.
Outdated
JSON objects in fields indicated in `fields`, a value of 2 will also decode the
Comment thread
leahleahy marked this conversation as resolved.
Outdated
objects embedded in the fields of these parsed documents. The default is 1.
objects embedded in the fields of these parsed documents. The default is `1`.
`target`:: (Optional) The field under which the decoded JSON will be written. By
default the decoded JSON object replaces the string field from which it was
default, the decoded JSON object replaces the string field from which it was
read. To merge the decoded JSON fields into the root of the event, specify
`target` with an empty string (`target: ""`). Note that the `null` value (`target:`)
is treated as if the field was not set at all.
`overwrite_keys`:: (Optional) A boolean that specifies whether keys that already
is treated as if the field was not set.
`overwrite_keys`:: (Optional) A Boolean that specifies whether keys already
Comment thread
leahleahy marked this conversation as resolved.
Outdated
exist in the event are overwritten by keys from the decoded JSON object. The
default value is false.
`expand_keys`:: (Optional) A boolean that specifies whether keys in the decoded JSON
should be recursively de-dotted, and expanded into a hierarchical object structure.
default value is `false`.
`expand_keys`:: (Optional) A Boolean that specifies whether keys in the decoded JSON
should be recursively de-dotted and expanded into a hierarchical object structure.
For example, `{"a.b.c": 123}` would be expanded into `{"a":{"b":{"c":123}}}`.
`add_error_key`:: (Optional) If it set to true, in case of error while decoding json keys
`error` field is going to be part of event with error message. If it set to false, there
will not be any error in event's field. Even error occurs while decoding json keys. The
default value is false.
`document_id`:: (Optional) JSON key to use as the document id. If configured,
the field will be removed from the original json document and stored in
`add_error_key`:: (Optional) If it set to `true`, in case of error while decoding JSON keys

@dedemorton dedemorton Apr 14, 2021

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This edit needs more work. The sentence is hard to parse and has grammatical issues.

@leahleahy leahleahy Apr 14, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reworked this, let me know what you think!

`error` field is going to be part of event with error message. If it set to `false`, there
will not be any error in event's field. Even error occurs while decoding JSON keys. The
default value is `false`.
`document_id`:: (Optional) JSON key that's used as the document ID. If configured,
the field will be removed from the original JSON document and stored in
`@metadata._id`