{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/", "slug": "dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter", "url": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/" }, "title": "Map dotted attribute names literally in a pipeline log exporter", "summary": "How should an Azure Monitor pipeline record map reference an attribute whose name contains a period?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:54+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 243, "potentially_affected": "Azure Monitor pipeline Log Analytics exporters using api.schema.recordMap for incoming log attributes.", "dse_recommendation": "Compare the literal incoming attribute keys with recordMap expressions before changing the destination table or transport.", "primary_source": { "name": "Troubleshoot Azure Monitor pipeline - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-troubleshoot", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The pipeline troubleshooting guide says recordMap does not support multilevel dot notation such as attributes.foo.bar; it directs users to bracket notation, attributes[‘foo.bar’], instead. The map must also supply TimeGenerated, and its target column names must match the destination schema. These requirements concern the exporter mapping, not just whether telemetry reached the receiver. Microsoft Learn.

\n

Applicability

\n

Inspect the actual incoming attribute names and the exporter’s api.schema.recordMap. This brief concerns a literal dotted key in that mapping; it does not define general JSON traversal or promise that every nested source structure has the same representation. Identify the intended destination columns before modifying the expression.

\n

DSE recommendation

\n

Compare the literal incoming attribute keys with recordMap expressions before changing the destination table or transport. Retain a redacted representative record beside the proposed mapping. Have the schema owner distinguish a period that belongs to the key from a presumed level in a hierarchy. Review the timestamp mapping and destination spelling in the same small change.

\n

Verification

\n

Send a harmless record with a known dotted attribute value and a known timestamp. Check the stored destination values rather than relying only on an accepted configuration or network connection. Include a record without that attribute to observe the approved handling of absence. Preserve the input, mapping, resulting columns, and any exporter error, and resolve mismatches before expanding the change to other dataflows.

\n

Official references

\n

Microsoft Learn: Troubleshoot Azure Monitor pipeline. Source reviewed September 9, 2026.

", "content_text": "Source facts\nThe pipeline troubleshooting guide says recordMap does not support multilevel dot notation such as attributes.foo.bar; it directs users to bracket notation, attributes[‘foo.bar’], instead. The map must also supply TimeGenerated, and its target column names must match the destination schema. These requirements concern the exporter mapping, not just whether telemetry reached the receiver. Microsoft Learn.\nApplicability\nInspect the actual incoming attribute names and the exporter’s api.schema.recordMap. This brief concerns a literal dotted key in that mapping; it does not define general JSON traversal or promise that every nested source structure has the same representation. Identify the intended destination columns before modifying the expression.\nDSE recommendation\nCompare the literal incoming attribute keys with recordMap expressions before changing the destination table or transport. Retain a redacted representative record beside the proposed mapping. Have the schema owner distinguish a period that belongs to the key from a presumed level in a hierarchy. Review the timestamp mapping and destination spelling in the same small change.\nVerification\nSend a harmless record with a known dotted attribute value and a known timestamp. Check the stored destination values rather than relying only on an accepted configuration or network connection. Include a record without that attribute to observe the approved handling of absence. Preserve the input, mapping, resulting columns, and any exporter error, and resolve mismatches before expanding the change to other dataflows.\nOfficial references\nMicrosoft Learn: Troubleshoot Azure Monitor pipeline. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nThe pipeline troubleshooting guide says recordMap does not support multilevel dot notation such as attributes.foo.bar; it directs users to bracket notation, attributes[‘foo.bar’], instead. The map must also supply TimeGenerated, and its target column names must match the destination schema. These requirements concern the exporter mapping, not just whether telemetry reached the receiver. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-troubleshoot).\n\n## Applicability\n\nInspect the actual incoming attribute names and the exporter’s api.schema.recordMap. This brief concerns a literal dotted key in that mapping; it does not define general JSON traversal or promise that every nested source structure has the same representation. Identify the intended destination columns before modifying the expression.\n\n## DSE recommendation\n\nCompare the literal incoming attribute keys with recordMap expressions before changing the destination table or transport. Retain a redacted representative record beside the proposed mapping. Have the schema owner distinguish a period that belongs to the key from a presumed level in a hierarchy. Review the timestamp mapping and destination spelling in the same small change.\n\n## Verification\n\nSend a harmless record with a known dotted attribute value and a known timestamp. Check the stored destination values rather than relying only on an accepted configuration or network connection. Include a record without that attribute to observe the approved handling of absence. Preserve the input, mapping, resulting columns, and any exporter error, and resolve mismatches before expanding the change to other dataflows.\n\n## Official references\n\n[Microsoft Learn: Troubleshoot Azure Monitor pipeline](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-troubleshoot). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/", "url": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Map dotted attribute names literally in a pipeline log exporter", "item": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/", "url": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/", "headline": "Map dotted attribute names literally in a pipeline log exporter", "description": "How should an Azure Monitor pipeline record map reference an attribute whose name contains a period?", "abstract": "How should an Azure Monitor pipeline record map reference an attribute whose name contains a period?", "articleBody": "Source facts\nThe pipeline troubleshooting guide says recordMap does not support multilevel dot notation such as attributes.foo.bar; it directs users to bracket notation, attributes[‘foo.bar’], instead. The map must also supply TimeGenerated, and its target column names must match the destination schema. These requirements concern the exporter mapping, not just whether telemetry reached the receiver. Microsoft Learn.\nApplicability\nInspect the actual incoming attribute names and the exporter’s api.schema.recordMap. This brief concerns a literal dotted key in that mapping; it does not define general JSON traversal or promise that every nested source structure has the same representation. Identify the intended destination columns before modifying the expression.\nDSE recommendation\nCompare the literal incoming attribute keys with recordMap expressions before changing the destination table or transport. Retain a redacted representative record beside the proposed mapping. Have the schema owner distinguish a period that belongs to the key from a presumed level in a hierarchy. Review the timestamp mapping and destination spelling in the same small change.\nVerification\nSend a harmless record with a known dotted attribute value and a known timestamp. Check the stored destination values rather than relying only on an accepted configuration or network connection. Include a record without that attribute to observe the approved handling of absence. Preserve the input, mapping, resulting columns, and any exporter error, and resolve mismatches before expanding the change to other dataflows.\nOfficial references\nMicrosoft Learn: Troubleshoot Azure Monitor pipeline. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:27:54+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Map dotted attribute names literally in a pipeline log exporter" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 243, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshoot Azure Monitor pipeline - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-troubleshoot" } } ] } }