Filebeat JSON processors

filebeat.yml

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /path/to/logs
    #- c:\programdata\elasticsearch\logs\*

  processors:
  - dissect:
      tokenizer: "[%{date} %{time} %{level}/%{worker}] %{details}"
      field: "message"
      target_prefix: "extracted"
      ignore_missing: true

  - decode_json_fields:
      fields: ["extracted.details"]
      target: "json"
      process_array: true
      max_depth: 1
      overwrite_keys: false