Is there a specific syntax for nested fields, such as `res.status:403`, or do you flatten the json structure for indexing purposes?