Filebeat json to Elasticsearch, error processing pipeline

Elastic Stack Elasticsearch
2

Perhaps take a look at this

https://www.elastic.co/guide/en/elasticsearch/reference/current/dot-expand-processor.html

"client.ip" is not a "valid" name / json construction with respect to elasticsearch.

{"client.ip":"8.8.8.8","email.from":"user@email.com"}

valid json should look like this

{"client" : {"ip":"8.8.8.8"} ,"email" : {"from":"user@email.com"}}

the grok in regular logs is creating the correct json.

So you might need to use the dot expander I referenced above

EDIT : This can seem a bit confusing because after you create valid json you can reference a field like client.ip but that is not the correct way to create it from a json document