Fix matching of leaf fields for objects

internal/fields/testdata/fields/fields.yml

@@ -88,3 +88,6 @@
     - array
 - name: user.group.id
   type: keyword
+- name: attributes
+  type: object
+  object_type: keyword

internal/fields/testdata/no-subobjects.json

@@ -0,0 +1,4 @@
+{
+  "attributes.id": "foo",
+  "attributes.status": "ok"
+}

internal/fields/testdata/subobjects.json

@@ -0,0 +1,6 @@
+{
+  "attributes": {
+    "id": "42",
+    "status": "ok"
+  }
+}

internal/fields/validate.go

@@ -985,6 +985,11 @@ func validSubField(def FieldDefinition, extraPart string) bool {
 	fieldType := def.Type
 	if def.Type == "object" && def.ObjectType != "" {
 		fieldType = def.ObjectType
+
+		// Match leaf fields for objects that don't have a wildcard at the end.
+		if parts := strings.Split(extraPart, "."); len(parts) == 2 && parts[0] == "" {
+			return true
+		}
 	}
 
 	subFields := []string{".lat", ".lon", ".values", ".counts"}
@@ -1114,7 +1119,7 @@ func (v *Validator) parseSingleElementValue(key string, definition FieldDefiniti
 			return fmt.Errorf("the IP %q is not one of the allowed test IPs (see: https://github.com/elastic/elastic-package/blob/main/internal/fields/_static/allowed_geo_ips.txt)", valStr)
 		}
 	// Groups should only contain nested fields, not single values.
-	case "group", "nested":
+	case "group", "nested", "object":
 		switch val := val.(type) {
 		case map[string]any:
 			// This is probably an element from an array of objects,
@@ -1138,7 +1143,19 @@ func (v *Validator) parseSingleElementValue(key string, definition FieldDefiniti
 			// The document contains a null, let's consider this like an empty array.
 			return nil
 		default:
-			return fmt.Errorf("field %q is a group of fields, it cannot store values", key)
+			switch {
+			case definition.Type == "object" && definition.ObjectType != "":
+				// This is the leaf element of an object without wildcards in the name, adapt the definition and try again.
+				definition.Name = definition.Name + ".*"
+				definition.Type = definition.ObjectType
+				definition.ObjectType = ""
+				return v.parseSingleElementValue(key, definition, val, doc)
+			case definition.Type == "object" && definition.ObjectType == "":
+				// Legacy mapping, abiguous definition not allowed by recent versions of the spec, ignore it.
+				return nil
+			}
+
+			return fmt.Errorf("field %q is a group of fields of type %s, it cannot store values", key, definition.Type)
 		}
 	// Numbers should have been parsed as float64, otherwise they are not numbers.
 	case "float", "long", "double":

internal/fields/validate_test.go

@@ -64,6 +64,25 @@ func TestValidate_WithFlattenedFields(t *testing.T) {
 	require.Empty(t, errs)
 }
 
+func TestValidate_ObjectTypeWithoutWildcard(t *testing.T) {
+	validator, err := CreateValidatorForDirectory("testdata",
+		WithDisabledDependencyManagement())
+	require.NoError(t, err)
+	require.NotNil(t, validator)
+
+	t.Run("subobjects", func(t *testing.T) {
+		e := readSampleEvent(t, "testdata/subobjects.json")
+		errs := validator.ValidateDocumentBody(e)
+		require.Empty(t, errs)
+	})
+
+	t.Run("no-subobjects", func(t *testing.T) {
+		e := readSampleEvent(t, "testdata/no-subobjects.json")
+		errs := validator.ValidateDocumentBody(e)
+		require.Empty(t, errs)
+	})
+}
+
 func TestValidate_WithNumericKeywordFields(t *testing.T) {
 	validator, err := CreateValidatorForDirectory("testdata",
 		WithNumericKeywordFields([]string{
@@ -824,6 +843,12 @@ func TestCompareKeys(t *testing.T) {
 			searchedKey: "example.foo",
 			expected:    true,
 		},
+		{
+			key:         "example",
+			def:         FieldDefinition{Type: "object", ObjectType: "keyword"},
+			searchedKey: "example.foo",
+			expected:    true,
+		},
 		{
 			key:         "example.foo",
 			searchedKey: "example.*",