I using the logstash-elasticsearch-filter to correlate events from Elasticsearch. Some of the fields that I need to return from the Elasticsearch hit are nested. I have been unable to retrieve these docs and the result is always null.
I am using Logstash 5.6.5 and ES 5.6.5.
Here is my configuration:
"fields" => { "field.otherField.anotherField" => "p_time_gmt" }
I have also tried:
[field][otherField][anotherField] [field][otherField][0][anotherField]
Without luck.
The json response from ES looks like:
field": {
"otherField": [
{
"anthorField": "someText"
}
]
}