Create Parent-Child relationship with Logstash

[RusseL (HASTURK)]

Hi Everyone;
I need to create a Parent-Chield relationship with Logstash.

I created index like this.

Here is the mapping

I try to create relationship using filter mutate as below picture

But I am getting this error

How Can I solve this problem?
Elasticsearch 7.16.2
Logstash 7.16.2

[leandrojmp (Leandro Pereira)]

There is no parent-child relationship in Logstash, this is a mapping concept of Elasticsearch.

You can't do what you are trying to do in logstash, your first mutate is adding the join_field as a string with the value of customer, this will create the field join_field in your document, you can't use another mutate in the sequence and change this to a json object.

This is what the error is telling you.

[RusseL (HASTURK)]

Thank you so much for your help. Actually what I'm looking for is the area I marked in yellow. I don't know if I did it right.

[leandrojmp (Leandro Pereira)]

I don't understand what is the issue, can you give more details?

If you are having issues with parent-child mappings, this post should be moved to the Elasticsearch forum as this is not related to Logstash.

Maybe some moderator can move the post to the correct forum, so more people can see it and try to give any help.