How can access nested fields with dots in pipeline processors

Elastic Stack Elasticsearch
1

Hi all,

I'm trying to access nested fields which names have dots in my pipeline proccessors, but I don't know how

This is my input json:

{
"customMsgAtts": {
"http.response.status": "200",
"http.response.info": "OK",
"http.request.verb": "POST",
"result":"OK"
},
"correlationId": "67fdce5b6c000b9e63fcc85f"
}

And this is my pipeline simulation:

{
"pipeline": {
"description": "apigtw_events_pipeline",
"processors": [
{
"json": {
"field": "message",
"target_field": "transaction"
}
},
{
"set": {
"field": "transactionresult",
"value": "{{transaction.customMsgAtts.result}}"
}
},
{
"set": {
"field": "transactionverb",
"value": "{{transaction.customMsgAtts.http.request.verb}}"
}
}
],
"on_failure": [
{
"set": {
"field": "_index",
"value": "failed-{{ _index }}"
}
},
{
"set" : {
"field" : "error",
"value" : "{{ _ingest.on_failure_message }}"
}
}
]
},
"docs": [
{
"_index": "my-index",
"_type": "my-type",
"_id": "my-id",
"_source": {
"message": "{"customMsgAtts": {"http.response.status": "200","http.response.info": "OK","http.request.verb": "POST","result":"OK"},"correlationId": "67fdce5b6c000b9e63fcc85f"}"
}
}
]
}

The result of the simulation is:

{
"docs": [
{
"doc": {
"_index": "my-index",
"_type": "my-type",
"_id": "my-id",
"_source": {
"transactionverb": "",
"transactionresult": "OK",
"message": "{"customMsgAtts": {"http.response.status": "200","http.response.info": "OK","http.request.verb": "POST","result":"OK"},"correlationId": "67fdce5b6c000b9e63fcc85f"}",
"transaction": {
"customMsgAtts": {
"result": "OK",
"http.response.status": "200",
"http.response.info": "OK",
"http.request.verb": "POST"
},
"correlationId": "67fdce5b6c000b9e63fcc85f"
}
},
"_ingest": {
"timestamp": "2019-02-21T14:01:37.585Z"
}
}
}
]
}

So, I can process result field inside customMsgAtts, but there is no way to process http.request.verb field (empty result)

Thanks in advance,

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.