Expand_keys doesn’t work if target option is used in decode_json_fields beat processor

[iorfix]

In decode_json_fields processor, expanded notation works only if target is left to "".
In fact, in source code ( beats/decode_json_fields.go at master · elastic/beats · GitHub ) there is a clear if section:

if target != "" {
	_, err = event.PutValue(target, output)
} else {
	switch t := output.(type) {
	case map[string]interface{}:
	    jsontransform.WriteJSONKeys(event, t, f.expandKeys, f.overwriteKeys, f.addErrorKey)
	default:
  	    errs = append(errs, "failed to add target to root")
	}
}

According to https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276 this is a bug

• Version: 7.16.3, 7.17.2
• Operating System: Linux Redhat 8
• Discuss Forum URL: https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276
• Steps to Reproduce:

1. Add the following section in filebeat.yml on the same node of a running elasticsearch instance with xpack audit enabled.
2. Verify that some fields (e.g. user.name, or event.action) are not "de-dotted", but json is a flat structure

- type: filestream
  id: audit_elasticsearch
  enabled: true
  paths:
    - /var/log/elasticsearch/mycluster_audit.json
  processors:
    - decode_json_fields:
        fields: message
        max_depth: 8
        expand_keys: true
        overwrite_keys: False
        target: json

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[botelastic]

This issue doesn't have a Team:<team> label.

[nixfloyd]

Folks, this is still an issue in latest 7.17.x, looks like the change has not been backported, e.g:
#32014 did not get merged