Logstash : How to extract a nested field from Json log and only index the content of the nested field

Elastic Stack Logstash
4

I think that you will need to use the ruby filter to put the nested fields under data into the root level of the document.

I'm not an expert in ruby, but this other question has an example that may work in your case.

It would be somehint like this, but you will need to test it out.

ruby { 
    code => 'event.get("data").each { | k, v| event.set(k, v) }' 
}
mutate { 
    remove_field => [ "data" ] 
}

Those filters would need to be after the prune filter.