I get this error message for the last Renameprocessor (Refer the last rule in Ingest Template). Iam running the Testpipeline. What is the right way to access the targetResources[userPrincipalName] in json.
"error": { "message": "field [targetResources.userPrincipalName] doesn't exist" ]}
This is the Ingest template
[
{
"date": {
"field": "activityDateTime",
"formats": [
"ISO8601"
],
"description": "set @timestamp"
}
},
{
"rename": {
"field": "activityDisplayName",
"target_field": "event.action",
"description": "activityDisplayName -> event.action"
}
},
{
"rename": {
"field": "initiatedBy.user.userPrincipalName",
"target_field": "IntiatedByUser",
"description": "initiatedBy.userPrincipalName -> IntiatedByUser"
}
},
{
"rename": {
"field": "targetResources.userPrincipalName",
"target_field": "TargetToUser",
"description": "targetResources.userPrincipalName -> TargetToUser"
}
}
]
This is the input json am using to test
{
"_index": "event.audit-group-api_data-2021-02-25-000001",
"_id": "WKdD33cBtqMuzOE8PK3s",
"_source": {
"id": "Directory_0e4fdfae-ad82-49a9-968b-e3f1dff55526_5HP78_48797866",
"category": "GroupManagement",
"correlationId": "0e4fdfae-ad82-49a9-968b-e3f1dff55526",
"result": "success",
"resultReason": "",
"activityDisplayName": "Remove member from group",
"activityDateTime": "2021-02-22T22:22:26.0666217Z",
"loggedByService": "Core Directory",
"operationType": "Unassign",
"initiatedBy": {
"app": null,
"user": {
"id": "saasasa-1457-4017-856a-39f81800aa10",
"displayName": null,
"userPrincipalName": "admin@mailerdev.onmicrosoft.com",
"ipAddress": null
}
},
"targetResources": [
{
"id": "7c7a1441-494c-43a2-bd83-88a49297eefb",
"displayName": null,
"type": "User",
"userPrincipalName": "userwhoneedsgroupchange@mailerdev.onmicrosoft.com",
"groupType": null,
"modifiedProperties": [
{
"displayName": "Group.ObjectID",
"oldValue": null,
"newValue": "\"2aec66af-384a-43ba-86f6-73cb4162b884\""
},
{
"displayName": "Group.DisplayName",
"oldValue": null,
"newValue": "\"Audit Log Test\""
},
{
"displayName": "Group.WellKnownObjectName",
"oldValue": null,
"newValue": null
}
]
},
{
"id": "2aec66af-384a-43ba-86f6-73cb4162b884",
"displayName": null,
"type": "Group",
"userPrincipalName": null,
"groupType": "unknownFutureValue",
"modifiedProperties": []
}
],
"additionalDetails": [],
"REMOTE_ADDR": "110.129.11.99",
"@timestamp": "2021-02-26T16:54:15.860831019+00:00"
}
}