# Creating/updating array of objects in elasticsearch logstash output

**URL:** https://discuss.elastic.co/t/creating-updating-array-of-objects-in-elasticsearch-logstash-output/59139
**Category:** Logstash
**Created:** [August 29, 2016, 1:56am UTC](https://discuss.elastic.co/t/creating-updating-array-of-objects-in-elasticsearch-logstash-output/59139 "2016-08-29T01:56:54Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Nandan\_Phadke](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@Nandan\_Phadke](https://discuss.elastic.co/u/Nandan_Phadke)
#### Post date: [August 29, 2016, 1:56am UTC](https://discuss.elastic.co/t/creating-updating-array-of-objects-in-elasticsearch-logstash-output/59139/1 "2016-08-29T01:56:55Z")

</div>

I am facing an issue using elastic search output with logstash. Here is my sample event

```
{
    "guid":"someguid",
    "nestedObject":{
        "field1":"val1",
        "field2":"val2"
    }
}

```

Here is what I want to have in my elastic search document after 2 upserts:

```
{
    "nestedObjects":[{
        "field1":"val1",
        "field2":"val2"
        },
        {
        "field3":"val3",
        "field4":"val4"
        }]
}

```

Here is my current elastic search output setting:

```
elasticsearch {
    index => "elastictest"
    action => "update"
    document_type => "summary"
    document_id => "%{guid}"
    doc_as_upsert => true
    script_lang => "groovy"
    script_type => "inline"
    retry_on_conflict => 3
    script => "
    if (ctx._source.nestedObjects) {
    ctx._source.nestedObjects += event.nestedObject
    } else {
    ctx._source.nestedObjects = [event.nestedObject]
    }
    "
    }

```

Here is the error I am getting:

```
response=>{"update"=>{"_index"=>"elastictest", "_type"=>"summary", "_id"=>"64648dd3-c1e9-45fd-a00b-5a4332c91ee9", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [event.nestedObject]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"unknown property [field1]"}}}}
```

---

<div class="post-metadata">

### Author: ![esamudio](https://avatars.discourse-cdn.com/v4/letter/e/df788c/32.png) [@esamudio](https://discuss.elastic.co/u/esamudio)
#### Post date: [August 30, 2016, 2:26am UTC](https://discuss.elastic.co/t/creating-updating-array-of-objects-in-elasticsearch-logstash-output/59139/2 "2016-08-30T02:26:49Z")

</div>

I think that you should ensure that nestedObject is an array to begin with, meaning that you should initialize it. They type error might be because you're trying to append to a non array field. I use a ruby filter for that (in the filter section):

> ruby {  
> code =\> "  
> event['nestedObject'] = ;  
> "  
> }

Afterwards, you can append to the array of the document using something like(inside of the ES output plugin):

> script =\> '  
> ctx.\_source.nestedObject.add("%{name\_of\_field\_with\_new\_values}");  
> '

---

<div class="post-metadata">

### Author: ![Nandan\_Phadke](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@Nandan\_Phadke](https://discuss.elastic.co/u/Nandan_Phadke)
#### Post date: [August 30, 2016, 4:30am UTC](https://discuss.elastic.co/t/creating-updating-array-of-objects-in-elasticsearch-logstash-output/59139/3 "2016-08-30T04:30:55Z")

</div>

Thanks Edgar, however the event from logstash was not the issue.

The issue turned out to be internally generated mapping in elastic due to other documents with same document\_type with conflicting type on nestedObject. This caused elastic to throw a parsing exception. Fixing this, fixed this issue.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/creating-updating-array-of-objects-in-elasticsearch-logstash-output/59139/4 "2017-07-06T04:41:00Z")

</div>