Hi and thanks for your question.
The logs itself use dotted and nested notation interchangeably. Before ingesting it to Elasticsearch, it's highly recommended to normalize to the nested notation. Either with Filebeat's expand_keys option (see Get started | ECS Logging Java Reference [1.x] | Elastic) or with an Elasticsearch ingest pipeline, using the dot_expander (see [Meta] Enable seamless ECS log onboarding for all log inputs · Issue #1454 · elastic/integrations · GitHub).