# Convert a field datatype to object or nested in logstash
**URL:** https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419
**Category:** Logstash
**Created:** [May 31, 2016, 11:11am UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419 "2016-05-31T11:11:49Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@star](https://discuss.elastic.co/u/star)
#### Post date: [May 31, 2016, 11:11am UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419/1 "2016-05-31T11:11:49Z")
I am unable to convert datatype of field to object or nested datatype. I get following error. Any suggestions appreciated.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 1, 2016, 1:22am UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419/2 "2016-06-01T01:22:41Z")
Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 1, 2016, 3:40am UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419/3 "2016-06-01T03:40:50Z")
Apart from what Mark said, post your configuration. The stacktrace alone isn't enough to debug this.
---
### Author:  [@star](https://discuss.elastic.co/u/star)
#### Post date: [June 1, 2016, 2:22pm UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419/4 "2016-06-01T14:22:35Z")
Use case is, there are two fields in my logs say "field1" and "field2". In elasticsearch I want to access field2 as field1.field2 . So at logstash level, I am trying to make field1 as array object.
This is my logstash config.
input{
tcp {
```
port => xxxx
codec=>"json"
```
}
}
filter {
csv {
columns =\> ["field1","field2"]
separator =\> ","
}
mutate {
convert =\> ["field1","object"]
rename =\> {"field2" =\> "[field1][field2]"}
}
}
output{
elasticsearch{
hosts =\> ["x.x.x.x:9200"]
index =\> "logstash-%{+YYYY.MM.dd}"
document\_type =\>"test"
manage\_template =\> "false"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 1, 2016, 2:26pm UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419/5 "2016-06-01T14:26:54Z")
> convert =\> ["field1","object"]
"object" isn't a valid value here.
I don't understand what you want the end result to be. Please give an example of the JSON document you want to get from your filters.
---
### Author:  [@star](https://discuss.elastic.co/u/star)
#### Post date: [June 2, 2016, 9:19am UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419/6 "2016-06-02T09:19:31Z")
It is just like collect\_set query in hive. I want to group by on one field and want to get array of unique values from other field.
Below is the JSON I got from elasticsearch after performing group by on 2 fields, city and hotels. Instead of that I want to group by on city and get distinct hotel names as array.
{ "key" : "Mumbai",
"doc\_count" : 31348,
"hotels in mumbai" : {
"doc\_count\_error\_upper\_bound" : 0,
"sum\_other\_doc\_count" : 250,
"buckets" : [ {
"key" : "The Lalit",
"doc\_count" : 20927
}, {
"key" : "Three Star",
"doc\_count" : 5421
}, {
"key" : "Holiday Inn",
"doc\_count" : 2295
}]
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 2, 2016, 10:42am UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419/7 "2016-06-02T10:42:56Z")
I meant the end result you want to get from Logstash. Please show
- the event as it look when it enters Logstash and
- the event as you want it to look when it's sent to Elasticsearch.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419/8 "2017-07-06T04:54:48Z")