Add raw json field when unmarshaling fails (#6591)

Add raw json to `message` field when JSON unmarshaling fails. This ensures that no data loss occurs.

Fixes #6516

CHANGELOG.asciidoc

@@ -62,6 +62,7 @@ https://github.com/elastic/beats/compare/v6.0.0-beta2...master[Check the HEAD di
 
 - Fix panic when log prospector configuration fails to load. {issue}6800[6800]
 - Fix memory leak in log prospector when files cannot be read. {issue}6797[6797]
+- Add raw JSON to message field when JSON parsing fails. {issue}6516[6516]
 
 *Heartbeat*
 

filebeat/harvester/reader/json.go

@@ -101,6 +101,13 @@ func MergeJSONFields(data common.MapStr, jsonFields common.MapStr, text *string,
 		jsonFields[config.MessageKey] = *text
 	}
 
+	// handle the case in which r.cfg.AddErrorKey is set and len(jsonFields) == 1
+	// and only thing it contains is `error` key due to error in json decoding
+	// which results in loss of message key in the main beat event
+	if len(jsonFields) == 1 && jsonFields["error"] != nil {
+		data["message"] = *text
+	}
+
 	if config.KeysUnderRoot {
 		// Delete existing json key
 		delete(data, "json")