Trino and Elasticsearch problem with ROW data type

[ziggekatten]

I have an problem accessing data i Elastic, and need some new ideas. THe index I'm working on is an index that collects metrics. All documents have common fields like timestamp, hostname tenant etc.

Now let's start with an document retrieved using select _source from default.logtable. This returns the following JSON:

{
    "@timestamp": "2025-05-15T15:34:25.000Z",
    "fs": {
        "label": "E:",
        "total": 53668151296
    },
    "host": {
        "hostname": "server01"
    },
    "odapi": {
        "key": "fs.total"
    },
    "tenant": {
        "name": "ACME Inc"
    }
}

As you can see in the data above, there are two keys under "fs"; "label" and "total"

doing an DESCRIBE logtable indicates named ROW datatype:

The following SQL Works fine:

select 
  "@timestamp" as timestamp, 
  fs.label as label
from default.logtable

and returns:

However, the following, trying to get the second key (total)
select
"@timestamp" as timestamp,
fs.total as total
from default.logtable

returns error: SQL Error [63]: Query failed (#20250515_160826_00058_9qtgt): line 3:3: Column reference 'fs.total' is invalid

Using ROW(fs)[1] works, but ROW(fs)[2] gives the same error above.

The data is clearly there when getting the source document, but it's not available. There are additional columns with the same problems. It's almost as Trino does not accept more than one named key in an column of type ROW. Any ideas?