# Creating nested fields with Grok
**URL:** https://discuss.elastic.co/t/creating-nested-fields-with-grok/197918
**Category:** Logstash
**Created:** [September 3, 2019, 5:19pm UTC](https://discuss.elastic.co/t/creating-nested-fields-with-grok/197918 "2019-09-03T17:19:40Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@carson](https://discuss.elastic.co/u/carson)
#### Post date: [September 3, 2019, 5:19pm UTC](https://discuss.elastic.co/t/creating-nested-fields-with-grok/197918/1 "2019-09-03T17:19:41Z")
I'm trying to create fields to measure request metrics from our profiler logs (i.e. number of requests, average request time, etc).
I have a filter with a grok match like such (shortened for simple understanding):
`match = > {"message": {%WORD:request_type} {%NUMBER:num_of_requests:int}`
for a log line with:
`exampleRequestType 77`
I want to create a nested field such as `exampleRequestType.num_of_requests` so that I can associate the various input metrics I'm getting, as I have many request types. However, I get an error when i tried these two different methods:
`match => { "message" : => %{WORD:request_type} %{NUMBER:[request_type][num_of_requests]:int}`
or by using the original match but doing a mutate `rename`:
`rename => { "num_of_requests" => "[request_type][num_of_requests]" }`
What is the correct way to do this? Thank you
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 3, 2019, 5:47pm UTC](https://discuss.elastic.co/t/creating-nested-fields-with-grok/197918/2 "2019-09-03T17:47:54Z")
In elasticsearch, a field can either be a value, such as a string or number or date, or an object that contains other fields. It cannot be both. So you cannot have request\_type be the string "exampleRequestType" and also contain a sub-field [num\_of\_requests].
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 1, 2019, 5:47pm UTC](https://discuss.elastic.co/t/creating-nested-fields-with-grok/197918/3 "2019-10-01T17:47:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.