# Confusion, dot-notation vs. sub-objects

**URL:** <https://discuss.elastic.co/t/confusion-dot-notation-vs-sub-objects/286199>\
**Category:** Logs\
**Tags:** ecs-elastic-common-schema\
**Created:** [October 8, 2021, 8:07am UTC](https://discuss.elastic.co/t/confusion-dot-notation-vs-sub-objects/286199 "2021-10-08T08:07:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anton-johansson](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@anton-johansson](https://discuss.elastic.co/u/anton-johansson)\
**Post date:** [October 8, 2021, 8:07am UTC](https://discuss.elastic.co/t/confusion-dot-notation-vs-sub-objects/286199/1 "2021-10-08T08:07:28Z")

</div>

We're a bit confused about the specification regarding dot-notation vs. sub-objects. If you look in the documentation, it is specified as dot-notation, see here:

> **[ECS Fields | Elastic Common Schema (ECS) Reference \[1.12\] | Elastic](https://www.elastic.co/guide/en/ecs/current/ecs-ecs.html)**

This is implemented as dot-notation in the Java/Log4j2-implementation, see here:

> <https://github.com/elastic/ecs-logging-java/blob/fb287cc003ca48cbb9440243b50d79031e2dfa4f/ecs-logging-core/src/main/java/co/elastic/logging/EcsJsonSerializer.java#L52>

However, in the JavaScript/Pino implementation, it's implemented as sub-objects:

> <https://github.com/elastic/ecs-logging-nodejs/blob/6e0566dbd937b137250c0305be00787b8649dd80/loggers/pino/index.js#L158>

... and can also be seen in examples here:

> **[@elastic/ecs-pino-format](https://www.npmjs.com/package/@elastic/ecs-pino-format)**
>
> A formatter for the pino logger compatible with Elastic Common Schema.

Which format is really the one to use? What happens if we use both layouts and put logs in the same Elasticsearch index. The mappings won't really look the same, will they?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![felixbarny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felixbarny/32/27341_2.png) [@felixbarny](https://discuss.elastic.co/u/felixbarny)\
**Post date:** [October 11, 2021, 6:52am UTC](https://discuss.elastic.co/t/confusion-dot-notation-vs-sub-objects/286199/2 "2021-10-11T06:52:19Z")

</div>

Hi and thanks for your question.

The logs itself use dotted and nested notation interchangeably. Before ingesting it to Elasticsearch, it's highly recommended to normalize to the nested notation. Either with Filebeat's `expand_keys` option (see [Get started | ECS Logging Java Reference [1.x] | Elastic](https://www.elastic.co/guide/en/ecs-logging/java/current/setup.html#setup-step-3)) or with an Elasticsearch ingest pipeline, using the `dot_expander` (see [[Meta] Enable seamless ECS log onboarding for all log inputs · Issue #1454 · elastic/integrations · GitHub](https://github.com/elastic/integrations/issues/1454)).

---

<div class="post-metadata">

**Author:** ![anton-johansson](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@anton-johansson](https://discuss.elastic.co/u/anton-johansson)\
**Post date:** [October 11, 2021, 3:15pm UTC](https://discuss.elastic.co/t/confusion-dot-notation-vs-sub-objects/286199/3 "2021-10-11T15:15:40Z")

</div>

Allright, thanks! We'll try the `expand_keys` option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2021, 3:15pm UTC](https://discuss.elastic.co/t/confusion-dot-notation-vs-sub-objects/286199/4 "2021-11-08T15:15:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.