AWS config logs are not being parsed properly for the AWS app. The full json elements are being included in the field names so I have fields that look like:
detail.configurationItem.availabilityZone
detail.configurationItem.awsAccountId
detail.configurationItem.awsRegion
detail.configurationItem.configuration.activeTrustedSigners.enabled
detail.configurationItem.configuration.activeTrustedSigners.quantity
detail.configurationItem.configuration.allocatedStorage
detail.configurationItem.configuration.amiLaunchIndex
detail.configurationItem.configuration.architecture
And I need to get rid of the detail.configurationItem.*. I can use rename to do this but that only works at search time. There are also about 1000 fields so entering them all as field aliases isn't an option.
Has anyone seen this before or have any suggestions how to remove the top level elements from the field name.
