title: Filebeat and json logs from Kubernetes not working
body: <p>I've setup a sample Kubernetes cluster using minikube with Elasticsearch and Kibana 6.8.6, and Filebeat 7.5.1.</p>
  
  <p>My application generate log messages in json format  <code>{"@timestamp":"2019-12-30T21:59:48+0000","message":"example","data":"data-462"}</code></p>
  
  <p>I can see the log message in Kibana, but my json log is embedded inside "message" atribute as a string:</p>
  
  <p><a href="https://i.stack.imgur.com/92BiE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/92BiE.png" alt="enter image description here"></a></p>
  
  <p>I configured <code>json.keys_under_root: true</code> to no effect (as stated in documentation: <a href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-config-json" rel="nofollow noreferrer">https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-config-json</a>)</p>
  
  <p>My configuration:</p>
  
  <pre><code>  filebeat.yml: |-
      migration.6_to_7.enabled: true
  
      filebeat.config:
        modules:
          path: ${path.config}/modules.d/*.yml
          reload.enabled: false
  
      filebeat.autodiscover:
        providers:
          - type: kubernetes
            hints.enabled: true
            hints.default_config.enabled: false
            json.keys_under_root: true
            json.add_error_key: true
  
      output.elasticsearch:
        hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
        username: ${ELASTICSEARCH_USERNAME}
        password: ${ELASTICSEARCH_PASSWORD}
  </code></pre>
  
  <pre><code>  kubernetes.yml: |-
      - type: docker
        containers.ids:
        - "*"
        processors:
          - add_kubernetes_metadata:
              in_cluster: true
  </code></pre>
  
  <p>I need the "message" and "data" fields as separate fields in Kibana.</p>
  
  <p>What I'm missing?</p>