Filebeat - processing kubelet json logs read from journald

filebeat.journald-kubelet.yml

filebeat.inputs:
  - type: journald
    processors:
      # For https://kubernetes.io/docs/concepts/cluster-administration/system-logs/#json-log-format
      - if:
          and:
            - equals.journald.process.name: kubelet
            - regexp.message: '^{'
        then:
          # 'kubelet' should be mapped as a flattened field in ES because
          # it can have arbitrary keys and value types.
          - decode_json_fields:
              fields:
                - message
              target: kubelet
          - convert:
              mode: rename
              fields:
                - { from: kubelet.msg, to: message }
                - { from: kubelet.v, to: log.level, type: "string" }
          - timestamp:
              field: kubelet.ts
              layouts:
                - UNIX
              test:
                - '1580306777.04728'
          - drop_fields:
              fields:
                - kubelet.ts