elastic
diff --git a/‎detection_rules/beats.py‎
Lines changed: 5 additions & 1 deletion b/‎detection_rules/beats.py‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎detection_rules/etc/beats_schemas/main.json.gz‎
0 Bytes b/‎detection_rules/etc/beats_schemas/main.json.gz‎
0 Bytes
diff --git a/‎detection_rules/etc/beats_schemas/v9.1.3.json.gz‎
0 Bytes b/‎detection_rules/etc/beats_schemas/v9.1.3.json.gz‎
0 Bytes
diff --git a/‎detection_rules/etc/ecs_schemas/1.12.0/ecs_flat.json.gz‎
0 Bytes b/‎detection_rules/etc/ecs_schemas/1.12.0/ecs_flat.json.gz‎
0 Bytes
diff --git a/‎detection_rules/etc/ecs_schemas/1.12.0/ecs_nested.json.gz‎
0 Bytes b/‎detection_rules/etc/ecs_schemas/1.12.0/ecs_nested.json.gz‎
0 Bytes
diff --git a/‎detection_rules/etc/ecs_schemas/1.12.1/ecs_flat.json.gz‎
0 Bytes b/‎detection_rules/etc/ecs_schemas/1.12.1/ecs_flat.json.gz‎
0 Bytes
diff --git a/‎detection_rules/etc/ecs_schemas/1.12.1/ecs_nested.json.gz‎
0 Bytes b/‎detection_rules/etc/ecs_schemas/1.12.1/ecs_nested.json.gz‎
0 Bytes
diff --git a/‎detection_rules/etc/ecs_schemas/1.12.2/ecs_flat.json.gz‎
0 Bytes b/‎detection_rules/etc/ecs_schemas/1.12.2/ecs_flat.json.gz‎
0 Bytes
diff --git a/‎detection_rules/etc/ecs_schemas/1.12.2/ecs_nested.json.gz‎
0 Bytes b/‎detection_rules/etc/ecs_schemas/1.12.2/ecs_nested.json.gz‎
0 Bytes
diff --git a/‎detection_rules/etc/ecs_schemas/8.0.0/ecs_flat.json.gz‎
0 Bytes b/‎detection_rules/etc/ecs_schemas/8.0.0/ecs_flat.json.gz‎
0 Bytes
@@ -128,7 +128,11 @@ def _flatten_schema(schema: list[dict[str, Any]] | None, prefix: str = "") -> li
 
             flattened.extend(_flatten_schema(s["fields"], prefix=nested_prefix))
         elif "fields" in s:
-            flattened.extend(_flatten_schema(s["fields"], prefix=prefix))
+            if s.get("name") and s.get("type") == "nested":
+                nested_prefix = prefix + s["name"] + "."
+                flattened.extend(_flatten_schema(s["fields"], prefix=nested_prefix))
+            else:
+                flattened.extend(_flatten_schema(s["fields"], prefix=prefix))
         elif "name" in s:
             _s = s.copy()
             # type is implicitly keyword if not defined