Fix ndjson parser to store JSON fields correctly under target

CHANGELOG.next.asciidoc

@@ -74,6 +74,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix recovering from invalid output configuration when running under Elastic-Agent {pull}36016[36016]
 - Improve StreamBuf append to improve performance when reading long lines from files. {pull}35928[35928]
 - Eliminate cloning of event in deepUpdate {pull}35945[35945]
+- Fix ndjson parser to store JSON fields correctly under `target` {issue}29395[29395]
 - Support build of projects outside of beats directory {pull}36126[36126]
 
 *Auditbeat*

libbeat/reader/parser/parser_test.go

@@ -367,6 +367,54 @@ func TestJSONParsersWithFields(t *testing.T) {
 				},
 			},
 		},
+		"JSON post processor with dotted target key": {
+			message: reader.Message{
+				Content: []byte("{\"key\":\"value\"}"),
+				Fields:  mapstr.M{},
+			},
+			config: map[string]interface{}{
+				"parsers": []map[string]interface{}{
+					map[string]interface{}{
+						"ndjson": map[string]interface{}{
+							"target": "kubernetes.audit",
+						},
+					},
+				},
+			},
+			expectedMessage: reader.Message{
+				Content: []byte(""),
+				Fields: mapstr.M{
+					"kubernetes": mapstr.M{
+						"audit": mapstr.M{
+							"key": "value",
+						},
+					},
+				},
+			},
+		},
+		"JSON post processor with non-dotted target key": {
+			message: reader.Message{
+				Content: []byte("{\"key\":\"value\"}"),
+				Fields:  mapstr.M{},
+			},
+			config: map[string]interface{}{
+				"parsers": []map[string]interface{}{
+					map[string]interface{}{
+						"ndjson": map[string]interface{}{
+							"target": "kubernetes",
+						},
+					},
+				},
+			},
+			expectedMessage: reader.Message{
+				Content: []byte(""),
+				Fields: mapstr.M{
+					"kubernetes": mapstr.M{
+						"key": "value",
+					},
+				},
+			},
+		},
 		"JSON post processor with document ID": {
 			message: reader.Message{
 				Content: []byte("{\"key\":\"value\", \"my-id-field\":\"my-id\"}"),

libbeat/reader/readjson/json.go

@@ -195,7 +195,9 @@
 		message.Fields = event.Fields
 		message.Meta = event.Meta
 	} else {
-		message.AddFields(mapstr.M{p.target: jsonFields})
+		fields := mapstr.M{}
+		fields.Put(p.target, jsonFields)
+		message.AddFields(fields)
 	}
 
 	return message, err
@@ -238,7 +240,7 @@
 			case time.Time:
 				ts = t
 			case common.Time:
 				ts = time.Time(ts)
 			}
 			delete(data, "@timestamp")
 		}