Parse the field "okta.target" with filebeat module
Right now, all other fields are parsed correctly. But for "okta.target" field, that still shows up as JSON and there are 4 sub-fields that you can't parse normally with mappings. Working with support to figure out how I can do this as-is but would be nice if that field was parsed out with filebeat module.
You should be able to see this with ANY okta log but I have attached 2 screenshots with field values obfuscated (they are all strings).


Parse the field "okta.target" with filebeat module
Right now, all other fields are parsed correctly. But for "okta.target" field, that still shows up as JSON and there are 4 sub-fields that you can't parse normally with mappings. Working with support to figure out how I can do this as-is but would be nice if that field was parsed out with filebeat module.
You should be able to see this with ANY okta log but I have attached 2 screenshots with field values obfuscated (they are all strings).

