# Create Parent-Child relationship with Logstash

**URL:** <https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198>\
**Category:** Logstash\
**Created:** [January 12, 2022, 6:15pm UTC](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198 "2022-01-12T18:15:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![RusseL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russel/32/77328_2.png) [@RusseL](https://discuss.elastic.co/u/RusseL)\
**Post date:** [January 12, 2022, 6:15pm UTC](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198/1 "2022-01-12T18:15:47Z")

</div>

Hi Everyone;  
I need to create a Parent-Chield relationship with Logstash.

I created index like this.  
 ![put](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2aaabe499e3d5ac03cd54547805314fe7754494e.png)

Here is the mapping  
 ![mapping](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed491ac32af212516266b79750ee8a7779daf6d1.png)

I try to create relationship using filter mutate as below picture

 ![logstash](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2bac0cd4807ec0951522a1d68a5755e89d48777d.png)

But I am getting this error  
 ![error](https://us1.discourse-cdn.com/elastic/original/3X/1/3/1372981fc02cd84bce2a9e8a1117a8454114c7ed.png)

How Can I solve this problem?  
Elasticsearch 7.16.2  
Logstash 7.16.2

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 12, 2022, 7:40pm UTC](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198/2 "2022-01-12T19:40:04Z")

</div>

There is no parent-child relationship in Logstash, this is a mapping concept of Elasticsearch.

You can't do what you are trying to do in logstash, your first mutate is adding the `join_field` as a string with the value of _customer_, this will create the field `join_field` in your document, you can't use another mutate in the sequence and change this to a json object.

This is what the error is telling you.

---

<div class="post-metadata">

**Author:** ![RusseL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russel/32/77328_2.png) [@RusseL](https://discuss.elastic.co/u/RusseL)\
**Post date:** [January 12, 2022, 8:12pm UTC](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198/3 "2022-01-12T20:12:58Z")

</div>

Thank you so much for your help. Actually what I'm looking for is the area I marked in yellow. I don't know if I did it right.

 ![parent](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e3e89e654d6857474e8902cd7b8e89faa1306bc2.png)

 ![ok](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c151cbcb35c8ee0657350fbb12487080a10977e.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 12, 2022, 8:22pm UTC](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198/4 "2022-01-12T20:22:19Z")

</div>

I don't understand what is the issue, can you give more details?

If you are having issues with parent-child mappings, this post should be moved to the Elasticsearch forum as this is not related to Logstash.

Maybe some moderator can move the post to the correct forum, so more people can see it and try to give any help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2022, 8:23pm UTC](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198/5 "2022-02-09T20:23:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.