diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index b7282a5bba2..dfc7ca72e7e 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -238,6 +238,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix ILM alias not being created if `setup.ilm.check_exists: false` and `setup.ilm.overwrite: true` has been configured. {pull}24480[24480]
 - Fix issue discovering docker containers and metadata after reconnections {pull}24318[24318]
 - Allow cgroup self-monitoring to see alternate `hostfs` paths {pull}24334[24334]
+- Add `expand_keys` to the list of permitted config fields for `decode_json_fields` {24862}[24862]
 
 *Auditbeat*
 
diff --git a/libbeat/processors/actions/decode_json_fields.go b/libbeat/processors/actions/decode_json_fields.go
index f546f4eaf54..611b5b8d8e3 100644
--- a/libbeat/processors/actions/decode_json_fields.go
+++ b/libbeat/processors/actions/decode_json_fields.go
@@ -70,7 +70,7 @@ func init() {
 	processors.RegisterPlugin("decode_json_fields",
 		checks.ConfigChecked(NewDecodeJSONFields,
 			checks.RequireFields("fields"),
-			checks.AllowedFields("fields", "max_depth", "overwrite_keys", "add_error_key", "process_array", "target", "when", "document_id")))
+			checks.AllowedFields("fields", "max_depth", "overwrite_keys", "add_error_key", "process_array", "target", "when", "document_id", "expand_keys")))
 
 	jsprocessor.RegisterPlugin("DecodeJSONFields", NewDecodeJSONFields)
 }
diff --git a/libbeat/processors/actions/decode_json_fields_test.go b/libbeat/processors/actions/decode_json_fields_test.go
index ca9c01b08d5..8b65d26224c 100644
--- a/libbeat/processors/actions/decode_json_fields_test.go
+++ b/libbeat/processors/actions/decode_json_fields_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/elastic/beats/v7/libbeat/beat"
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/logp"
+	"github.com/elastic/beats/v7/libbeat/processors"
 )
 
 var fields = [1]string{"msg"}
@@ -35,6 +36,29 @@ var testConfig, _ = common.NewConfigFrom(map[string]interface{}{
 	"processArray": false,
 })
 
+func TestDecodeJSONFieldsCheckConfig(t *testing.T) {
+	// All fields defined in config should be allowed.
+	cfg := common.MustNewConfigFrom(map[string]interface{}{
+		"decode_json_fields": &config{
+			// Rely on zero values for all fields that don't have validation.
+			MaxDepth: 1,
+		},
+	})
+	_, err := processors.New(processors.PluginConfig([]*common.Config{cfg}))
+	assert.NoError(t, err)
+
+	// Unknown fields should not be allowed.
+	cfg = common.MustNewConfigFrom(map[string]interface{}{
+		"decode_json_fields": map[string]interface{}{
+			"fields":     []string{"required"},
+			"extraneous": "field",
+		},
+	})
+	_, err = processors.New(processors.PluginConfig([]*common.Config{cfg}))
+	assert.Error(t, err)
+	assert.EqualError(t, err, "unexpected extraneous option in decode_json_fields")
+}
+
 func TestMissingKey(t *testing.T) {
 	input := common.MapStr{
 		"pipeline": "us1",