# Create a table from array of objects

**URL:** https://discuss.elastic.co/t/create-a-table-from-array-of-objects/259519
**Category:** Kibana
**Created:** [December 23, 2020, 6:06pm UTC](https://discuss.elastic.co/t/create-a-table-from-array-of-objects/259519 "2020-12-23T18:06:19Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Oscar\_de\_Dios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oscar_de_dios/32/81335_2.png) [@Oscar\_de\_Dios](https://discuss.elastic.co/u/Oscar_de_Dios)
#### Post date: [December 23, 2020, 6:06pm UTC](https://discuss.elastic.co/t/create-a-table-from-array-of-objects/259519/1 "2020-12-23T18:06:19Z")

</div>

Hi.  
I have some logs like this:  
log1 {  
someField: [{ name: 'A', occurrencies: 4}, {name: 'B', occurencies: 10}]  
}  
log2 {  
someField: [{ name: 'A', occurrencies: 2}, {name: 'B', occurencies: 12} , name: 'C', occurencies: 3]  
}

I want a table like this:

name ocurrencies  
A 14  
B 22  
C 3

I can only get the sum of all ocurrencies (A 39 B 39 C 39)

Thanks in advance.

---

<div class="post-metadata">

### Author: ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [December 23, 2020, 6:21pm UTC](https://discuss.elastic.co/t/create-a-table-from-array-of-objects/259519/2 "2020-12-23T18:21:26Z")

</div>

This is not possible in standard tables because [arrays are not handled the way you expect in Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/array.html), and because Kibana has a lot of limitations around the Nested type which would otherwise be a workaround.

If you can change the format of your data, your best option is to create a **separate document for each entry in the array**.

---

<div class="post-metadata">

### Author: ![Oscar\_de\_Dios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oscar_de_dios/32/81335_2.png) [@Oscar\_de\_Dios](https://discuss.elastic.co/u/Oscar_de_Dios)
#### Post date: [December 24, 2020, 10:31am UTC](https://discuss.elastic.co/t/create-a-table-from-array-of-objects/259519/3 "2020-12-24T10:31:59Z")

</div>

Hi, thanks for your answer @wylie .  
I can change the format of the data, I'm not sure If I undestand you, then the best option will be something like this?  
[{ newField: { name: 'A', ocurrencies: 10}, {newField: { name: 'B' ... etc

---

<div class="post-metadata">

### Author: ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [December 28, 2020, 4:18pm UTC](https://discuss.elastic.co/t/create-a-table-from-array-of-objects/259519/4 "2020-12-28T16:18:37Z")

</div>

Not exactly. I was suggesting that you don't use arrays at all, and instead ingest a _separate document for each entry in the array_. If you happen to use Logstash, this is done using the [split filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html). Otherwise, it would be done by whatever method you normally ingest data.

---

<div class="post-metadata">

### Author: ![Oscar\_de\_Dios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oscar_de_dios/32/81335_2.png) [@Oscar\_de\_Dios](https://discuss.elastic.co/u/Oscar_de_Dios)
#### Post date: [December 30, 2020, 11:04am UTC](https://discuss.elastic.co/t/create-a-table-from-array-of-objects/259519/5 "2020-12-30T11:04:40Z")

</div>

Finally I created an object with a different property for each array element.

Thank you for your help @wylie!

Happy new year.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 27, 2021, 11:05am UTC](https://discuss.elastic.co/t/create-a-table-from-array-of-objects/259519/6 "2021-01-27T11:05:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
