Eland: How to access and filter nested fields in a DataFrame?

[Paddyns (Pat)]

Hi,

I'm trying to use the examples from the ELAND docs e.g. this filtering example from github

df[(df.Carrier=="Kibana Airlines") & (df.AvgTicketPrice > 900.0) & (df.Cancelled == True)].head()

But the fields I have all seem to have points in them like agent.hostname so the char '.' in the fields are giving me issues e.g.

df[(df.agent.hostname=="SERVER1")].head()
results in
AttributeError: 'DataFrame' object has no attribute 'agent'

Can I change the field names in the ELAND DataFrame without affecting them in ElasticStack or how could I deal with these unusual field names while not dumping all the data to a local Pandas Dataframe?

@sethmlarson call out

[sethmlarson (Seth Michael Larson)]

Hello! Looks like your fields may have dots in the names? (ie agent.hostname) Currently Eland doesn't support nested fields being accessed this way, could you open a feature request on GitHub for this?

Instead you should access your fields like so:

df[df["agent.hostname"] == "SERVER1"].head()

Hope this helps!

[Paddyns (Pat)]

Thank you @sethmlarson - this allowed me pull back the data. I'll submit a feature request on Github
Funny thing when I do use your query method it's shows as CAPITALs in the output while I must use lowercase in the query statement like below - this had me stuck for a while.

df[df["agent.hostname"] == "server1"].head()