For example I want to search for messageId in the json data using message.messageId or if I want to search for the code can I search it using message.code ? In simple terms I want to search with the keys in the message section. is it possible ?
Alternatively, are you developing an app? Because its easier with Kafka.
Just configure Kafka connector in your app, with mapped fields.
Kafka will transfer all formats, and fields to logstash -> elastic. Also this will be more cpu friendly since grok takes lot of cpu/ram if not configured properly