Problem

In ECS a self-nesting is when one field set is nested inside itself using a different name:

Two examples:

• process.parent.* self-nests the process field set renamed as parent
• user.target.* self-nests the user.* field set renamed as target (same applies to user.changes and user.effective)

In a very specific case, you may want to self nest the same field set twice:

1. Reuse process.* as process.target.*
2. Reuse process again but underneath process.target.* to create process.target.parent.*

The current ECS tooling allows specifying this in the reusable.expected section, but it will not produce the desired result:

- name: process
  reusable:
    expected:
      - at: process
        as: target
      # collect the parent of the target process at process.target.parent
      - at: process.target
        as: parent

Solution

Implement logic into the self-nesting phase of .finalize to account for when the at attribute is not the top-level field set but an existing self-nesting.