# Map dotted attribute names literally in a pipeline log exporter

> How should an Azure Monitor pipeline record map reference an attribute whose name contains a period?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:54+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 2 minutes

## What you need to know

How should an Azure Monitor pipeline record map reference an attribute whose name contains a period?

## Potentially affected

Azure Monitor pipeline Log Analytics exporters using api.schema.recordMap for incoming log attributes.

## DSE recommendation

Compare the literal incoming attribute keys with recordMap expressions before changing the destination table or transport.

## Article

## Source facts

The pipeline troubleshooting guide says recordMap does not support multilevel dot notation such as attributes.foo.bar; it directs users to bracket notation, attributes[‘foo.bar’], instead. The map must also supply TimeGenerated, and its target column names must match the destination schema. These requirements concern the exporter mapping, not just whether telemetry reached the receiver. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-troubleshoot).

## Applicability

Inspect the actual incoming attribute names and the exporter’s api.schema.recordMap. This brief concerns a literal dotted key in that mapping; it does not define general JSON traversal or promise that every nested source structure has the same representation. Identify the intended destination columns before modifying the expression.

## DSE recommendation

Compare the literal incoming attribute keys with recordMap expressions before changing the destination table or transport. Retain a redacted representative record beside the proposed mapping. Have the schema owner distinguish a period that belongs to the key from a presumed level in a hierarchy. Review the timestamp mapping and destination spelling in the same small change.

## Verification

Send a harmless record with a known dotted attribute value and a known timestamp. Check the stored destination values rather than relying only on an accepted configuration or network connection. Include a record without that attribute to observe the approved handling of absence. Preserve the input, mapping, resulting columns, and any exporter error, and resolve mismatches before expanding the change to other dataflows.

## Official references

[Microsoft Learn: Troubleshoot Azure Monitor pipeline](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-troubleshoot). Source reviewed September 9, 2026.

## Primary reference

- Name: Troubleshoot Azure Monitor pipeline - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-troubleshoot
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Map dotted attribute names literally in a pipeline log exporter,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-242-map-dotted-attribute-names-literally-in-a-pipeline-log-exporter/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.