% This is generated by ESQL's FieldExtractTests. Do not edit it. See docs/reference/query-languages/esql/README.md for how to regenerate it.

## Description

Extracts the value of a single sub-field from a [`flattened` field](/reference/elasticsearch/mapping-reference/flattened.md) root as `keyword`.

The first argument must be a field whose ES mapping type is `flattened` (the root of the flattened object).
The second argument is the *literal* name of the sub-field to extract, that is, exactly the dotted key as
stored in doc values for the flattened root. For example, `field_extract(resource.attributes, "host.name")`
looks up the literal storage key `host.name`. The dot is part of the key, not a path separator. Nested
objects in the original document also collapse to dotted keys (an input `{"a":{"b":"x"}}` is stored as the
flat key `a.b`), so the same dotted form addresses both flat and originally-nested sub-fields.

JSONPath syntax is not supported: brackets (`['host.name']`) and array indices (`tags[0]`) are rejected.
Path matching is case-sensitive.

Returns `null` if either argument is `null`, if no sub-field with that name exists, or if the stored value
is JSON `null`. Returns `null` and emits a warning if the root value is not valid JSON.

String values are returned without surrounding quotes, numbers and booleans as their string representation,
and objects and arrays as JSON strings. When the sub-field is multi-valued in the flattened field, the
result is a multi-valued `keyword` block.

