diff --git a/pkg/approvaltest/approvals.go b/pkg/approvaltest/approvals.go
index 7b6b638..8f6fda2 100644
--- a/pkg/approvaltest/approvals.go
+++ b/pkg/approvaltest/approvals.go
@@ -58,7 +58,7 @@ func ApproveEvents(t testing.TB, name string, hits []espoll.SearchHit, dynamic .
 	for i, hit := range hits {
 		sources[i] = hit.RawSource
 	}
-	rewriteDynamic(t, sources, dynamic...)
+	rewriteDynamic(t, sources, false, dynamic...)
 	// Rewrite dynamic fields and sort them for repeatable diffs.
 	sort.Slice(sources, func(i, j int) bool {
 		return compareDocumentFields(sources[i], sources[j]) < 0
@@ -85,7 +85,7 @@ func ApproveFields(t testing.TB, name string, hits []espoll.SearchHit, dynamic .
 		fields[i] = hit.RawFields
 	}
 	// Rewrite dynamic fields and sort them for repeatable diffs.
-	rewriteDynamic(t, fields, dynamic...)
+	rewriteDynamic(t, fields, true, dynamic...)
 	sort.Slice(fields, func(i, j int) bool {
 		return compareDocumentFields(fields[i], fields[j]) < 0
 	})
@@ -93,8 +93,10 @@ func ApproveFields(t testing.TB, name string, hits []espoll.SearchHit, dynamic .
 }
 
 // rewriteDynamic rewrites all dynamic fields to have a known value, so dynamic
-// fields don't affect diffs.
-func rewriteDynamic(t testing.TB, srcs [][]byte, dynamic ...string) {
+// fields don't affect diffs. The flattenedKeys parameter defines how the
+// field should be queried in the source, if flattenedKeys is passed as true
+// then the source will be queried for the dynamic fields as flattened keys.
+func rewriteDynamic(t testing.TB, srcs [][]byte, flattenedKeys bool, dynamic ...string) {
 	t.Helper()
 
 	// Fields generated by the server (e.g. observer.*)
@@ -113,7 +115,9 @@ func rewriteDynamic(t testing.TB, srcs [][]byte, dynamic ...string) {
 
 	for i := range srcs {
 		for _, field := range dynamic {
-			field = strings.ReplaceAll(field, ".", "\\.")
+			if flattenedKeys {
+				field = strings.ReplaceAll(field, ".", "\\.")
+			}
 			existing := gjson.GetBytes(srcs[i], field)
 			if !existing.Exists() {
 				continue