Using dot notation in POCO used with NEST search

Elastic Stack Elasticsearch
1

I have a type of entry in elastic that is made of some imbricated properties like

{
    "_source":
    {
        "pipeline_version":1.7,
        "agent":{
            "hostname":"MyServer",
            "id":"a1df2f4e-6dde-43fd-8af6-b3726124fdf7",
            "type":"winlogbeat",
            "ephemeral_id":"78be9770-dab9-4c56-a67e-b1a372a2f899",
            "version":"7.5.1"
        }
    }, [...]
}

I'm trying to get my POCO to represent a flatten vie of this object. According to what I found in the documentation, I tried doing something in the like of

    Friend Class ElasticEventLogEntry
      <Nest.PropertyName("agent.hostname")>
      Public Property AgentHostName As String
      [...]
    End Class

But no matter what I try, the value is always empty. I've seen some other posts using the NestedAttribute attribute but from what I could find, this is only useful if we want to also create nested objects in our POCO structure which isn't my case.

My actual solution is to use private classes and private properties to deserialize and then add the flat property which point to the private object. I find this solution to be akward even more since the dot notation works with querying (q.Term(Function(e) e.AgentHostName, "MyServer")))

What am I missing?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.