Perfect, this works. I think elastic team should also implement arbitrary field references for all Logstash Elasticsearch configurations in future.