For some reason this doesn't seem to be anywhere on the internet.
Anyhu, the correct way to access this is:
Assuming the input:
{
"foo" : {
"bar": "baz"
}
}
You could get the value of foo.bar
with:
"%{foo[bar]}"
or
"%{[foo][bar]}"
Example usage:
mutate {
add_field => {
"other_field" => "%{[foo][bar]}"
}
}
.. hope someone finds that useful :)