Parser security_result.action_details empty

Hi,

I am developing a custom parser for a email-security product with JSON logs.

Everything is working as intended, except for information I want to include under “security_result.action_details” UDM field, which does not get populated whatever I try.

My code is as follows:

if [event][scan][indicators] != "" {
  for indicator in [event][scan][indicators] {
    mutate {
      replace => {
        "action_details" => "indicator"
      }
    }

    mutate {
      merge => {
        "security_result.action_details" => "action_details"
      }
    }

    mutate {
      merge => {
        "udm_event.idm.read_only_udm.security_result" => "security_result"
      }
    }
  }
}

With the json log having information in this format (redacted all other information about the email and left only the structure and relevant field):
 

{
    "event": {
        "scan": {
            "indicators": [
                "MachineLearningGood",
                "SuspiciousUri"
            ],
            "aiClassifier": "neutral"
        },
        "reject": null,
        "userReleasable": true,
    }
}

All other information I extract such as date, email addresses, IP, hostname are being correctly assiegned to UDM fields, but in this case the UDM “security_result.action_details” remains completely empty. I did not see any necessary precondition in the documentation, my events have no security_event.about and the event_type is EMAIL_UNCATEGORIZED.

Any idea what could be the issue?
Thanks