From ecf75a4df59fa0d8aa0e1687b054336b4b88c4fb Mon Sep 17 00:00:00 2001
From: kaiyan-sheng <kaiyan.sheng@elastic.co>
Date: Wed, 7 Oct 2020 08:22:34 -0600
Subject: [PATCH] [Filebeat S3] Change log.file.path to be nested object
 (#21624)

(cherry picked from commit 030077ce9098bbb419fe92843a2ce3ad25860b20)
---
 x-pack/filebeat/input/s3/collector.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/x-pack/filebeat/input/s3/collector.go b/x-pack/filebeat/input/s3/collector.go
index 73e12acfeab6..1b8905132845 100644
--- a/x-pack/filebeat/input/s3/collector.go
+++ b/x-pack/filebeat/input/s3/collector.go
@@ -552,8 +552,10 @@ func createEvent(log string, offset int, info s3Info, objectHash string, s3Ctx *
 		Fields: common.MapStr{
 			"message": log,
 			"log": common.MapStr{
-				"offset":    int64(offset),
-				"file.path": constructObjectURL(info),
+				"offset": int64(offset),
+				"file": common.MapStr{
+					"path": constructObjectURL(info),
+				},
 			},
 			"aws": common.MapStr{
 				"s3": common.MapStr{