Can't rename a field to user.name

Mhmh I don't really get what you wrote. Guess you are confusing the index with the index-pattern. The latter is only a "mask" to see your data. If you delete it, you're not changing the mapping of the index. The only way to change a mapping for a field that already exists in a index is to reindex your data (applying a mapping BEFORE reindexing the events).

Now, what you posted above (the table view and the JSON view) are exactly the same thing, a user field which is of type object and has a nested field name in it.

If you explain here what exactly you would like to achieve, I could help you get it done.

Would you be ok for you to have the value of that field in another field user_name or username? If that's the case, you can avoid the reindex. If you want to have a root field user.name, you'll need to reindex the data.

Though, I sincerely recommend you to avoid such a choice.