The ECS guidelines mention that “The document structure should be nested JSON objects.”. However, some ECS fields, such as cloud.instance.id are defined as dotted fields under a group.

While this is handled just fine in the Elasticsearch template using a nested properties object, the generated Go code contains the dotted field name just like any regular field name. I don’t think a document using a nested JSON object for such a field will properly deserialize using the generated code (aside from the Go code not having any json: keys in the struct field tags at all).