From fc15f7edcef78638a986488b4e80c9258063f8f9 Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Tue, 13 Apr 2021 18:24:36 -0400 Subject: [PATCH 1/7] Update decode_json_fields.asciidoc --- .../actions/docs/decode_json_fields.asciidoc | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/libbeat/processors/actions/docs/decode_json_fields.asciidoc b/libbeat/processors/actions/docs/decode_json_fields.asciidoc index fba3342032c..65ad26e1735 100644 --- a/libbeat/processors/actions/docs/decode_json_fields.asciidoc +++ b/libbeat/processors/actions/docs/decode_json_fields.asciidoc @@ -23,26 +23,26 @@ processors: The `decode_json_fields` processor has the following configuration settings: `fields`:: The fields containing JSON strings to decode. -`process_array`:: (Optional) A boolean that specifies whether to process -arrays. The default is false. -`max_depth`:: (Optional) The maximum parsing depth. A value of 1 will decode the +`process_array`:: (Optional) A Boolean that specifies whether to process +arrays. The default is `false`. +`max_depth`:: (Optional) The maximum parsing depth. A value of one will decode the JSON objects in fields indicated in `fields`, a value of 2 will also decode the -objects embedded in the fields of these parsed documents. The default is 1. +objects embedded in the fields of these parsed documents. The default is `1`. `target`:: (Optional) The field under which the decoded JSON will be written. By -default the decoded JSON object replaces the string field from which it was +default, the decoded JSON object replaces the string field from which it was read. To merge the decoded JSON fields into the root of the event, specify `target` with an empty string (`target: ""`). Note that the `null` value (`target:`) -is treated as if the field was not set at all. -`overwrite_keys`:: (Optional) A boolean that specifies whether keys that already +is treated as if the field was not set. +`overwrite_keys`:: (Optional) A Boolean that specifies whether keys already exist in the event are overwritten by keys from the decoded JSON object. The -default value is false. -`expand_keys`:: (Optional) A boolean that specifies whether keys in the decoded JSON -should be recursively de-dotted, and expanded into a hierarchical object structure. +default value is `false`. +`expand_keys`:: (Optional) A Boolean that specifies whether keys in the decoded JSON +should be recursively de-dotted and expanded into a hierarchical object structure. For example, `{"a.b.c": 123}` would be expanded into `{"a":{"b":{"c":123}}}`. -`add_error_key`:: (Optional) If it set to true, in case of error while decoding json keys -`error` field is going to be part of event with error message. If it set to false, there -will not be any error in event's field. Even error occurs while decoding json keys. The -default value is false. -`document_id`:: (Optional) JSON key to use as the document id. If configured, -the field will be removed from the original json document and stored in +`add_error_key`:: (Optional) If it set to `true`, in case of error while decoding JSON keys +`error` field is going to be part of event with error message. If it set to `false`, there +will not be any error in event's field. Even error occurs while decoding JSON keys. The +default value is `false`. +`document_id`:: (Optional) JSON key that's used as the document ID. If configured, +the field will be removed from the original JSON document and stored in `@metadata._id` From 7c356c4cbc422f06a640e31920445e1e4869aeb7 Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 16:48:19 -0400 Subject: [PATCH 2/7] Update libbeat/processors/actions/docs/decode_json_fields.asciidoc Co-authored-by: DeDe Morton --- libbeat/processors/actions/docs/decode_json_fields.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbeat/processors/actions/docs/decode_json_fields.asciidoc b/libbeat/processors/actions/docs/decode_json_fields.asciidoc index 65ad26e1735..639e84fa06b 100644 --- a/libbeat/processors/actions/docs/decode_json_fields.asciidoc +++ b/libbeat/processors/actions/docs/decode_json_fields.asciidoc @@ -25,7 +25,7 @@ The `decode_json_fields` processor has the following configuration settings: `fields`:: The fields containing JSON strings to decode. `process_array`:: (Optional) A Boolean that specifies whether to process arrays. The default is `false`. -`max_depth`:: (Optional) The maximum parsing depth. A value of one will decode the +`max_depth`:: (Optional) The maximum parsing depth. A value of `1` will decode the JSON objects in fields indicated in `fields`, a value of 2 will also decode the objects embedded in the fields of these parsed documents. The default is `1`. `target`:: (Optional) The field under which the decoded JSON will be written. By From fae051dbf6533a706ed758cd9945b7721082ee54 Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 16:48:31 -0400 Subject: [PATCH 3/7] Update libbeat/processors/actions/docs/decode_json_fields.asciidoc Co-authored-by: DeDe Morton --- libbeat/processors/actions/docs/decode_json_fields.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbeat/processors/actions/docs/decode_json_fields.asciidoc b/libbeat/processors/actions/docs/decode_json_fields.asciidoc index 639e84fa06b..429fe117110 100644 --- a/libbeat/processors/actions/docs/decode_json_fields.asciidoc +++ b/libbeat/processors/actions/docs/decode_json_fields.asciidoc @@ -26,7 +26,7 @@ The `decode_json_fields` processor has the following configuration settings: `process_array`:: (Optional) A Boolean that specifies whether to process arrays. The default is `false`. `max_depth`:: (Optional) The maximum parsing depth. A value of `1` will decode the -JSON objects in fields indicated in `fields`, a value of 2 will also decode the +JSON objects in fields indicated in `fields`, a value of `2` will also decode the objects embedded in the fields of these parsed documents. The default is `1`. `target`:: (Optional) The field under which the decoded JSON will be written. By default, the decoded JSON object replaces the string field from which it was From 9bb286069532879775cf9c663bc2004760d7b3ac Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 17:01:24 -0400 Subject: [PATCH 4/7] Update libbeat/processors/actions/docs/decode_json_fields.asciidoc Co-authored-by: DeDe Morton --- libbeat/processors/actions/docs/decode_json_fields.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbeat/processors/actions/docs/decode_json_fields.asciidoc b/libbeat/processors/actions/docs/decode_json_fields.asciidoc index 429fe117110..b30b6b4f0f6 100644 --- a/libbeat/processors/actions/docs/decode_json_fields.asciidoc +++ b/libbeat/processors/actions/docs/decode_json_fields.asciidoc @@ -33,7 +33,7 @@ default, the decoded JSON object replaces the string field from which it was read. To merge the decoded JSON fields into the root of the event, specify `target` with an empty string (`target: ""`). Note that the `null` value (`target:`) is treated as if the field was not set. -`overwrite_keys`:: (Optional) A Boolean that specifies whether keys already +`overwrite_keys`:: (Optional) A Boolean that specifies whether keys that already exist in the event are overwritten by keys from the decoded JSON object. The default value is `false`. `expand_keys`:: (Optional) A Boolean that specifies whether keys in the decoded JSON From c9cc5c1f44935a08c3fa7d7b5fc1845699d7475d Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 17:03:45 -0400 Subject: [PATCH 5/7] Update decode_json_fields.asciidoc --- .../processors/actions/docs/decode_json_fields.asciidoc | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libbeat/processors/actions/docs/decode_json_fields.asciidoc b/libbeat/processors/actions/docs/decode_json_fields.asciidoc index b30b6b4f0f6..816ad269841 100644 --- a/libbeat/processors/actions/docs/decode_json_fields.asciidoc +++ b/libbeat/processors/actions/docs/decode_json_fields.asciidoc @@ -23,7 +23,7 @@ processors: The `decode_json_fields` processor has the following configuration settings: `fields`:: The fields containing JSON strings to decode. -`process_array`:: (Optional) A Boolean that specifies whether to process +`process_array`:: (Optional) A Boolean value that specifies whether to process arrays. The default is `false`. `max_depth`:: (Optional) The maximum parsing depth. A value of `1` will decode the JSON objects in fields indicated in `fields`, a value of `2` will also decode the @@ -33,10 +33,9 @@ default, the decoded JSON object replaces the string field from which it was read. To merge the decoded JSON fields into the root of the event, specify `target` with an empty string (`target: ""`). Note that the `null` value (`target:`) is treated as if the field was not set. -`overwrite_keys`:: (Optional) A Boolean that specifies whether keys that already -exist in the event are overwritten by keys from the decoded JSON object. The +`overwrite_keys`:: (Optional) A Boolean value that specifies whether existing keys in the event are overrwritten by keys from the decoded JSON object. The default value is `false`. -`expand_keys`:: (Optional) A Boolean that specifies whether keys in the decoded JSON +`expand_keys`:: (Optional) A Boolean value that specifies whether keys in the decoded JSON should be recursively de-dotted and expanded into a hierarchical object structure. For example, `{"a.b.c": 123}` would be expanded into `{"a":{"b":{"c":123}}}`. `add_error_key`:: (Optional) If it set to `true`, in case of error while decoding JSON keys From 1a677fa6002f0fd71f893af6b2521a74493ed9a2 Mon Sep 17 00:00:00 2001 From: leahleahy <82116004+leahleahy@users.noreply.github.com> Date: Wed, 14 Apr 2021 17:12:38 -0400 Subject: [PATCH 6/7] Update decode_json_fields.asciidoc --- .../processors/actions/docs/decode_json_fields.asciidoc | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/libbeat/processors/actions/docs/decode_json_fields.asciidoc b/libbeat/processors/actions/docs/decode_json_fields.asciidoc index 816ad269841..337ced48665 100644 --- a/libbeat/processors/actions/docs/decode_json_fields.asciidoc +++ b/libbeat/processors/actions/docs/decode_json_fields.asciidoc @@ -33,15 +33,12 @@ default, the decoded JSON object replaces the string field from which it was read. To merge the decoded JSON fields into the root of the event, specify `target` with an empty string (`target: ""`). Note that the `null` value (`target:`) is treated as if the field was not set. -`overwrite_keys`:: (Optional) A Boolean value that specifies whether existing keys in the event are overrwritten by keys from the decoded JSON object. The +`overwrite_keys`:: (Optional) A Boolean value that specifies whether existing keys in the event are overwritten by keys from the decoded JSON object. The default value is `false`. `expand_keys`:: (Optional) A Boolean value that specifies whether keys in the decoded JSON should be recursively de-dotted and expanded into a hierarchical object structure. For example, `{"a.b.c": 123}` would be expanded into `{"a":{"b":{"c":123}}}`. -`add_error_key`:: (Optional) If it set to `true`, in case of error while decoding JSON keys -`error` field is going to be part of event with error message. If it set to `false`, there -will not be any error in event's field. Even error occurs while decoding JSON keys. The -default value is `false`. +`add_error_key`:: (Optional) If set to `true`, the `error` field is a part of the event with the error message. If set to `false`, there will not be any error in the event field. This error occurs while decoding JSON keys. The default value is `false`. `document_id`:: (Optional) JSON key that's used as the document ID. If configured, the field will be removed from the original JSON document and stored in `@metadata._id` From b7b920accb97ce09881d369ba75842e5a697d373 Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Tue, 20 Apr 2021 12:36:50 -0700 Subject: [PATCH 7/7] Update libbeat/processors/actions/docs/decode_json_fields.asciidoc --- libbeat/processors/actions/docs/decode_json_fields.asciidoc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libbeat/processors/actions/docs/decode_json_fields.asciidoc b/libbeat/processors/actions/docs/decode_json_fields.asciidoc index 337ced48665..e1606ec880b 100644 --- a/libbeat/processors/actions/docs/decode_json_fields.asciidoc +++ b/libbeat/processors/actions/docs/decode_json_fields.asciidoc @@ -38,7 +38,8 @@ default value is `false`. `expand_keys`:: (Optional) A Boolean value that specifies whether keys in the decoded JSON should be recursively de-dotted and expanded into a hierarchical object structure. For example, `{"a.b.c": 123}` would be expanded into `{"a":{"b":{"c":123}}}`. -`add_error_key`:: (Optional) If set to `true`, the `error` field is a part of the event with the error message. If set to `false`, there will not be any error in the event field. This error occurs while decoding JSON keys. The default value is `false`. +`add_error_key`:: (Optional) If set to `true` and an error occurs while decoding JSON keys, +the `error` field will become a part of the event with the error message. If set to `false`, there will not be any error in the event's field. The default value is `false`. `document_id`:: (Optional) JSON key that's used as the document ID. If configured, the field will be removed from the original JSON document and stored in `@metadata._id`