Hi I can not figure out how to access a field that is outside the _source. The grok processor with the field nested I can't access, or the rename processor too. Tried to access the data with ctx, _source, _index. Don't know what to do.
POST /_ingest/pipeline/_simulate?verbose
{
"pipeline" :
{
"description": "_description",
"processors":[
{
"grok": {
"field": "statusChangeHistory.L.M.changeRequestReceivedDate.S",
"patterns": [
"%{YEAR:ano}-%{MONTHNUM:mes}-%{MONTHDAY:dia}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}"
],
"ignore_missing": true,
"ignore_failure": true
}
},
{
"rename": {
"field": "_source.fields",
"target_field": "field_xxx"
}
}
]
},
"docs": [
{
"_index": "transaction_service",
"_type": "_doc",
"_id": "aut_e1c30967",
"_score": null,
"_source": {
"statusChangeHistory": {
}
},
"fields": {
"statusChangeHistory.L.M.changeRequestReceivedDate.S": [
"2021-01-05T13:48:34.496Z",
"2021-01-05T13:49:06.000Z"
],
"transactionDate.S": [
"2021-01-05T03:00:00.000Z"
],
"transactionReceivedDateTime.S": [
"2021-01-05T13:48:34.496Z"
]
},
"sort": [
1609854514496
]
}
]
}