Convert value of nested date field to UTC with date filter

[alxsss]

Hello,

I am trying to convert values of all date fields to UTC. I use date filter, which works fine for top level fields. However, looks like it does not work for nested fields like

"abc" : [
{
"dateField" : "2020-09-11T00:00:00-08:00",
}
]
I tried date filter like
date {
match => [ "[abc][dateField]" , "ISO8601" , "yyyy-MM-dd'T'HH:mm:ss.SSS a Z" ]
target => "[abc][dateField]"
locale => "en"
#timezone => "America/Los_Angeles"
}

but there is no change.

Any ideas what is wrong here?
Thx in advance.

[ptamba]

@alxsss

"abc" : [
{
"dateField" : "2020-09-11T00:00:00-08:00",
}
]

this is not nested but array. if there's only one entry, you should be able to access it with [abc][0][dateField]

if it's arbitrary length, you will need ruby filter to iterate over it.