Confusion, dot-notation vs. sub-objects

We're a bit confused about the specification regarding dot-notation vs. sub-objects. If you look in the documentation, it is specified as dot-notation, see here:

This is implemented as dot-notation in the Java/Log4j2-implementation, see here:

However, in the JavaScript/Pino implementation, it's implemented as sub-objects:

... and can also be seen in examples here:

Which format is really the one to use? What happens if we use both layouts and put logs in the same Elasticsearch index. The mappings won't really look the same, will they?

Thanks in advance!

Hi and thanks for your question.

The logs itself use dotted and nested notation interchangeably. Before ingesting it to Elasticsearch, it's highly recommended to normalize to the nested notation. Either with Filebeat's expand_keys option (see Get started | ECS Logging Java Reference [1.x] | Elastic) or with an Elasticsearch ingest pipeline, using the dot_expander (see [Meta] Enable seamless ECS log onboarding for all log inputs · Issue #1454 · elastic/integrations · GitHub).

Allright, thanks! We'll try the expand_keys option.