How to find the data from nested log

[john_snow]

I am using below query 
index=aws earliest=-12h eventName=AuthorizeSecurityGroupIngress "items{}.cidrIp"="0.0.0.0/0" AND "items{}.port"!=8080 AND "items{}.port"!=22 AND "items{}.port"!=80 AND "items{}.port"!=443 

to get data like if a user is making any changes and using the above-mentioned ports then it is not going to show the data and it is giving me the exact results but when I have a log that has nested ports then it is not giving me the actual result. eg

items: []

    {port: 12345}
    {port: 22}
It means if we have a nested log and it contains the above-mentioned ports then it should show the result.

Any thoughts on this?

[to4kawa]

try spath , mvexpand , make table and search what you want.