Query Information

PPL Command/Query:

source=bounty-types | where int_field = 42 | eval modified = json_set(json_data, '$.name', 'modified_alice') | fields modified
source=bounty-types | where int_field = 42 | eval deleted = json_delete(json_data, '$.name') | fields deleted

Expected Result:

• json_set should update name to modified_alice.
• json_delete should remove name key.

Actual Result:

• json_set returns HTTP 500 with invalid input (kvs: ["$.","modified_alice"]).
• json_delete returns original JSON unchanged.

Dataset Information

Dataset/Schema Type

• OpenTelemetry (OTEL)
• Simple Schema for Observability (SS4O)
• Open Cybersecurity Schema Framework (OCSF)
• Custom (details below)

Index Mapping

{
  "mappings": {
    "properties": {
      "int_field": { "type": "integer" },
      "json_data": { "type": "keyword" }
    }
  }
}

Sample Data

{
  "int_field": 42,
  "json_data": "{\"name\":\"alice\",\"scores\":[90,85,92]}"
}

Bug Description

Issue Summary:
JSONPath $.key handling in json_set/json_delete is broken (json_set crashes, json_delete no-op).

Steps to Reproduce:

1. Create index with JSON string field.
2. Insert sample row.
3. Run both queries above.
4. Observe HTTP 500 for json_set and unchanged output for json_delete.

Impact:
Core JSON mutation functions are unreliable with standard JSONPath syntax.