Please help with Logstash template
I have a section in a document that has this section:
"target": [
{
"type": "AppInstance",
"alternateId": "Slack",
"displayName": "Slack",
"id": "id",
"detailEntry": {
"signOnModeType": "SAML_2_0"
}
},
{
"type": "AppUser",
"alternateId": "id",
"displayName": "name",
"id": "id",
"detailEntry": null
}
],
I'm unable to see the contents of this field in my map when added as a Tooltip field. I'm assuming this is because of my mapping. How can I map this in a template so I can view the alternateId and displayName or even all I'm not picky?