fix sub field name usage if there are 3 or more fields..

Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
veritasr3x · Aug 25, 2020 · 76910ea · 76910ea
1 parent 0d713e4
commit 76910ea
Showing 1 changed file with 1 addition and 3 deletions.
diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py
@@ -160,10 +160,8 @@ def fieldNameMapping(self, fieldname, value, *agg_option):
             keyword_subfield_name = '.%s'%keyword_subfield_name
 
         # Set naming for analyzed fields
-        if analyzed_subfield_name != '' and not keyword_subfield_name.startswith('.'):
+        if analyzed_subfield_name != '':
             analyzed_subfield_name = '.%s'%analyzed_subfield_name
-        else:
-            analyzed_subfield_name = ''
 
         # force keyword on agg_option used in Elasticsearch DSL query key
         if agg_option: