I am attempting to standardize many of our log data sets using the Elastic Common Schema. One of the common practices there is to nest, fieldnames using the JSON object format.
But I'm not sure why you would choose to use JSON objects as opposed to just flat fieldnames for these datasets. Beats also use JSON object mappings, but I don't see the reason.
I started testing some mappings for this, but ultimately I'm just wondering: Why would you choose to use JSON objects as opposed to just flat fieldnames?
Example object datatype mapping:
Example flat mapping:
I feel like I must be missing something and don't want to take a large design decision now that I will regret later.