Set all nested fields value into master field

[Raynald (M. Cuillerier Raynald)]

Hi everyone,
I have an index that can growth with many nested fileds, and we want to limit nested field to one sub-level for identified fields. But we want to keep value of this nested fields into the master field

Example : we have [Properties][Request] and some nested fields under. We want to merge all nested fields value in this field [Properties][Request]

"Properties": {
  "Request": {
    "SourceApplicationName": "Pulsar",
    "_typeTag": "BusMessage",
    "ResponseContent": {
      "TransactionBoutiqueId": "e383cde3-c802-4068-8141-41b3e91614a2"
    },
    "MessageType": "CreationTransactionBoutique"
  },

Nested fields created =

Is this possible with ruby code ? May I have to change type of this field like object ?
Please help me

[Badger]

If you use

ruby { code => 'event.set("[Properties][Request]", event.get("[Properties][Request]").to_s)' }

then you will get

"Properties" => {
    "Request" => "{\"ResponseContent\"=>{\"TransactionBoutiqueId\"=>\"e383cde3-c802-4068-8141-41b3e91614a2\"}, \"SourceApplicationName\"=>\"Pulsar\", \"_typeTag\"=>\"BusMessage\", \"MessageType\"=>\"CreationTransactionBoutique\"}"
}

Is that what you want?

[Raynald (M. Cuillerier Raynald)]

@Badger

ruby { code => 'event.set("[Properties][Request]", event.get("[Properties][Request]").to_s)' }

It seems great, but I have this error now :
[2020-12-04T18:32:30,541][WARN ][logstash.outputs.elasticsearch][filebeat][6e073c6b616c6ca446d26fab2bb97470efec21ec69c1856a775e76d571d79480] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"pulsar", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x5301153d>], :response=>{"index"=>{"_index"=>"pulsar", "_type"=>"_doc", "_id"=>"Sw7PLnYBuisqXDVb-dMb", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [Properties.Request] tried to parse field [Request] as object, but found a concrete value"}}}}

Should I have to change index mapping for this field ?
Thx Badger.

[Raynald (M. Cuillerier Raynald)]

Resolved with delete index to have new mapping. And then it is OK.

Thank you !!