Cannot filter a parsed record

Hello everyone,

I am trying to extract a remote_addr from json nginx logs and submit that to geoip2_c.

While debugging, it seems I’m unable to use the extracted record remote_addr (I see it perfectly in elasticsearch).

I did multiple attempts trying to copy to another record to ease debugging.

Here are fluent logs:

fluentd_1   | 2021-12-26 15:31:41.000000000 +0000 docker.mo.nginxssl: {"nginx.time_local":"26/Dec/2021:15:31:41 +0000","nginx.remote_addr":"172.18.0.1","nginx.remote_user":"","nginx.request":"GET /api/1.0/art.... HTTP/1.1","nginx.status":"200","nginx.body_bytes_sent":"8220","nginx.request_time":"0.332","nginx.http_referrer":"https://something.local/art...","nginx.http_user_agent":"Mozilla/5.0 ....","nginx.request_uri":"/api/1.0/art...","host":null,"host2":"-  -","host3":"-  -","host4":"-  -","host5":"-  -","host6":null,"hostname":"b899d766ac01","tag":"docker.mo.nginxssl","stack_name":"mo","service_name":"nginxssl","fluentd_hostname":"devfluent"}
fluentd_1   | 2021-12-26 15:31:41 +0000 [warn]: #0 unknown placeholder `${nginx.remote_addr}` found
fluentd_1   | 2021-12-26 15:31:41 +0000 [warn]: #0 unknown placeholder `${nginx.remote_addr}` found
fluentd_1   | 2021-12-26 15:31:41 +0000 [warn]: #0 unknown placeholder `${remote_addr}` found
fluentd_1   | 2021-12-26 15:31:41 +0000 [warn]: #0 unknown placeholder `${log.remote_addr}` found
fluentd_1   | 2021-12-26 15:31:41 +0000 [warn]: #0 unknown placeholder `${log.nginx.remote_addr}` found
fluentd_1   | 2021-12-26 15:31:41 +0000 [warn]: #0 unknown placeholder `${nginx['remote_addr']}` found

Please note it doesn’t work any better without the inject_key_prefix

Relevant configuration bits:

<filter docker.mo.nginxssl>
  @type parser
  key_name log
  reserve_time true
  inject_key_prefix "nginx."
  <parse>
    @type json
  </parse>
</filter>



<filter docker.mo.nginxssl>
  @type record_transformer
  <record>
    host "${nginx.remote_addr}"
    host2 "- ${nginx.remote_addr} -"
    host3 "- ${remote_addr} -"
    host4 "- ${log.remote_addr} -"
    host5 "- ${log.nginx.remote_addr} -"
    host6 ${nginx['remote_addr']}
  </record>
</filter>

Am I wrong to assume nginx.remote_addr would be directly available?

Thank you.

Found.
This works:

${record["nginx.remote_addr"]}