How to handle dot in field names in ES 7.0

Elastic Stack Elasticsearch
8

One of the problem you have is:

  • "execution.command":"/bin/bash",
  • "execution.command.args":".-1"

Here you try to say that execution.command is a text. And execution.command.args is the args field inside execution.command object. Which would mean that execution.command should be both an object and a text field. Which is not possible.

You should rewrite your document field names in a way they are not seen as objects. Like:

{  
   "execution_command":"/bin/bash",
   "execution_command_args":".-1"
}
3 Likes