title: How to access nested fields in logstash filter step?
body: <p>I'm trying to send my Apache logs down a different pipeline in Logstash. But first  I need to identify them, which I thought the following filter should do:</p>
  
  <pre><code>filter {
      if  "apache" in [fileset].[module] {
          tags =&gt; ["apache2"]
      }
  }
  </code></pre>
  
  <p>But that breaks everything, and I see this (pertinent part only) error:</p>
  
  <pre><code>Failed to execute action {:action=&gt;LogStash::PipelineAction::Create/pipeline_id:main, :exception=&gt;"LogStash::ConfigurationError", :message=&gt;"Expected one of [, #, and, or, xor, nand, { at line 20, column 30 (byte 241) after filter {\n    if  \"apache\" in [fileset]",
  </code></pre>
  
  <p>I'm not sure what else to do.</p>
  
  <p>The <code>fileset.module</code> isn't a line that's in the log files, obviously - Filebeat is adding it in. But since it's added in, I thought I should be able to read it in Logstash. Anyone have any ideas? </p>