Packetbeat Processors - Dropping fields from nested objects in an array

[yotamgod (Yotam Rosenmann)]

Also, here is the error I get:
Failed to copy fields in copy_fields processor: could not fetch value for key: dns.answers.data, Error: expected map but type is common.MapStr

I think it might have to do with the following issue:

Using a processor in a filebeat module may or may not actually find fields

(Elasticsearch and filebeat are both v7.2) I was encountering a lot of difficulty using the convert processor to change types, so I simplified things down to using rename. The results of my tests are confusing. Given the following config block, I'd expect 6 fields to get renamed: - module: osquery result: enabled: true input: processors: - rename: fields: - from: "input.type" to: "input.typerenamed" - from: "fileset.name" …