elastic/kibana
View on GitHub[Security Solution][Detection Engine] Nested fields with dots in the name can't be used in exceptions
Open
#244966 opened on Dec 2, 2025
Feature:Rule ExceptionsTeam:Detection Enginebugeffort:lowgood first issueurgency:normalvalue:high
Description
When adding an exception, if a nested field has sub-fields with dots in the name, e.g. hash.sha256 (or there are multiple levels of sub-fields) then the UI presents only the last part of the sub-field name (sha256)as an option. Attempting to select sha256 does not work.
Mapping
PUT test
{
"mappings": {
"properties": {
"@timestamp": {
"type": "date"
},
"event.category": {
"type": "keyword"
},
"my_nested_field": {
"type": "nested",
"properties": {
"hash": {
"properties": {
"sha256": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"path": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
}
}
Steps to Repro
- Create an index with the mapping above
- Create a query rule that uses the created index as its source index. The rule query and other settings do not matter.
- Open the "Add Exception" flyout for the rule
- Click "Add nested condition" and select
my_nested_field.hash.sha256as the fieldmy_nested_fieldwill be added as the nested field, buthash.sha256will not be added as the sub-field. In the sub-field dropdown,sha256is shown but selecting it there doesn't work either.
If other my_nested_field.path is selected instead, you can see that path is automatically added as the sub-field.