How to DQL the nested field(group)?

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
opensearch 2.7.0

Describe the issue:
mapping table

"url": {
      "type": "nested",
      "properties": {
        "ppp": {
          "type": "keyword"
        },
        "protocol": {
          "type": "keyword"
        },
        "fqdn": {
          "type": "keyword"
        },
        "port": {
          "type": "integer"
        },
        "urlid": {
          "type": "keyword"
        },
        "url": {
          "type": "keyword"
        }
      }
    }

and I put a document in the index

POST log-network-2023.09-000035/_doc
{
  "@timestamp": "2023-09-20T06:49:02Z",
  "uuid": "test",
    "url": [
    {
      "fqdn": "xxx",
      "method": "GET",
      "port": 443,
      "ppp": "xxx.json",
      "responsecode": 200,
      "url": "xxx",
      "urlid": "xxx"
    },
    {
      "fqdn": "xxx",
      "method": "GET",
      "port": 80,
      "ppp": "xxx",
      "responsecode": 200,
      "url": "xxx",
      "urlid": "xxx"
    }
  ]
}

in DQL
url: {port: 443} → error
image
image

also url.port: 443 not found result
image

so, how do DQL the nested group?

2

@cucukaka As per OpenSearch documentation, the correct DQL query for the nested field is:

url: {port: 443}

image
image1416×549 54.8 KB