Yes, for the fields in root, there is no problem. I omit one point : the structure json is in another structure JSON ... , hence the "SOURCE_KEY = field:message" in transforms.conf { "root": { "...
See more...
Yes, for the fields in root, there is no problem. I omit one point : the structure json is in another structure JSON ... , hence the "SOURCE_KEY = field:message" in transforms.conf { "root": { "field1": "value1", "message": { "var1":132, "var2":toto", "var3":{}, "var4":{"A":1,"B":2}, "var5":{"C":{"D":5}} } } After indexing, field1 is accessible, because the structure source json is seeing as a JSON. And interpreted like that. I need to parse message to find the var* like field1.