I'm trying to use Painless to do a transform for a Slack alert message. I believe I've followed the standard for using Painless to be able to persist the field that have a dot in them. However, those fields always show up as null. I'm not sure what I'm doing wrong. Any help would be appreciated.
Here is the request:
And here is the response. Notice that agent.version and host.hostname are NULL in the transform.
That did work. Thank you. I read in another post that Painless needed the brackets around the fields that had "." in the field name. I removed those and it worked great.
Some info below for others to reference and understand better in the future.
['host']['hostname'] traverses the host object and accesses the hostname key
['host.hostname'] accesses the key "host.hostname" which doesn’t exist