Elastic Flattened Fields Explained

Elastic has many “Field Types”. Flattened is a type that allows you to search subfields. Typically for cyber security analysts subfields appear in cloud logs, especially requests and responses, where the person who built the parser needed it to be future-proofed against the ever changing cloud.

For instance, if we had the following JSON in a flattened field called “user”:

{
    "User": {
        "Path": "/",
        "UserName": "Bobby",
        "UserId": "AIDAIOSFOPLL2EXAMPAA",
        "Arn": "arn:aws:iam::12345677701:user/Bobby",
        "CreateDate": "2024-06-22T17:50:52+00:00",
        "PermissionsBoundary": {
        "PermissionsBoundaryType": "Policy",
        "PermissionsBoundaryArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess"
        }
    }
}

user:*AmazonS3FullAccess*
----
user:*12345677701*
----
user:*Bobby*

Elastic advertises such flattened fields with the following ICON –