From b2d2a6f681ba0ed1d200b0553c654a6e8b5a7555 Mon Sep 17 00:00:00 2001
From: Denis Rechkunov <denis.rechkunov@elastic.co>
Date: Tue, 25 Nov 2025 14:48:10 +0100
Subject: [PATCH 1/2] Add more tests for the ndjson parser behavior

---
 libbeat/reader/readjson/json_test.go | 40 ++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/libbeat/reader/readjson/json_test.go b/libbeat/reader/readjson/json_test.go
index a49c63d399d8..d2f102064a40 100644
--- a/libbeat/reader/readjson/json_test.go
+++ b/libbeat/reader/readjson/json_test.go
@@ -89,6 +89,16 @@ func TestUnmarshal(t *testing.T) {
 				"b": float64(-1),
 			},
 		},
+		{
+			Name:  "Key collision",
+			Input: `{"log.level":"info","log":{"source":"connectors-py-default"},"log":{"logger":"agent_component.cli"}}`,
+			Output: map[string]interface{}{
+				"log.level": "info",
+				"log": map[string]interface{}{
+					"logger": "agent_component.cli",
+				},
+			},
+		},
 	}
 
 	for _, test := range tests {
@@ -351,6 +361,36 @@ func TestMergeJSONFields(t *testing.T) {
 			JSONConfig:    Config{ExpandKeys: true, KeysUnderRoot: true},
 			ExpectedItems: mapstr.M{"a": mapstr.M{"b": mapstr.M{"c": "c", "d": "d"}}},
 		},
+		"key collision with expanded keys": {
+			Data: mapstr.M{
+				"log.level": "info",
+				"log": mapstr.M{
+					"logger": "agent_component.cli",
+				},
+			},
+			JSONConfig: Config{ExpandKeys: true},
+			ExpectedItems: mapstr.M{
+				"log.level": "info",
+				"log": mapstr.M{
+					"logger": "agent_component.cli",
+				},
+			},
+		},
+		"key collision without expanded keys": {
+			Data: mapstr.M{
+				"log.level": "info",
+				"log": mapstr.M{
+					"logger": "agent_component.cli",
+				},
+			},
+			JSONConfig: Config{ExpandKeys: false},
+			ExpectedItems: mapstr.M{
+				"log.level": "info",
+				"log": mapstr.M{
+					"logger": "agent_component.cli",
+				},
+			},
+		},
 	}
 
 	for name, test := range tests {

From 1ef47f73d6c2b39110924fdfc20210f6fbd8b215 Mon Sep 17 00:00:00 2001
From: Denis Rechkunov <denis.rechkunov@elastic.co>
Date: Tue, 25 Nov 2025 15:17:29 +0100
Subject: [PATCH 2/2] Add a test case

---
 libbeat/reader/readjson/json_test.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/libbeat/reader/readjson/json_test.go b/libbeat/reader/readjson/json_test.go
index d2f102064a40..f44120c40502 100644
--- a/libbeat/reader/readjson/json_test.go
+++ b/libbeat/reader/readjson/json_test.go
@@ -391,6 +391,21 @@ func TestMergeJSONFields(t *testing.T) {
 				},
 			},
 		},
+		"key collision with overwrite": {
+			Data: mapstr.M{
+				"log.level": "info",
+				"log": mapstr.M{
+					"logger": "agent_component.cli",
+				},
+			},
+			JSONConfig: Config{OverwriteKeys: true, AddErrorKey: true, IgnoreDecodingError: true},
+			ExpectedItems: mapstr.M{
+				"log.level": "info",
+				"log": mapstr.M{
+					"logger": "agent_component.cli",
+				},
+			},
+		},
 	}
 
 	for name, test := range tests {