# Display nested rows in Kibana

**URL:** <https://discuss.elastic.co/t/display-nested-rows-in-kibana/150925>\
**Category:** Kibana\
**Created:** [October 3, 2018, 5:42pm UTC](https://discuss.elastic.co/t/display-nested-rows-in-kibana/150925 "2018-10-03T17:42:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![frankfoti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankfoti/32/26965_2.png) [@frankfoti](https://discuss.elastic.co/u/frankfoti)\
**Post date:** [October 3, 2018, 5:42pm UTC](https://discuss.elastic.co/t/display-nested-rows-in-kibana/150925/1 "2018-10-03T17:42:43Z")

</div>

We are returning the list of elasticsearch snapshots from logstash http\_polling and want to display the snapshots in a table format. See below partial data set. Not sure how to do that. Does 6.4 have a way to do that without flattening the index?

{  
"took": 5,  
"timed\_out": false,  
"\_shards": {  
"total": 5,  
"successful": 5,  
"skipped": 0,  
"failed": 0  
},  
"hits": {  
"total": 1,  
"max\_score": 1,  
"hits": [  
{  
"\_index": "elasticsearch-backup",  
"\_type": "backup",  
"\_id": "rrc102-production",  
"\_score": 1,  
"\_source": {  
"snapshots": [  
{  
"shards": {  
"total": 17,  
"successful": 17  
},  
"snapshot": "snapshot-201804131000"  
},  
{  
"shards": {  
"total": 17,  
"successful": 17  
},  
"snapshot": "snapshot-201804131003"  
},  
{  
"shards": {  
"total": 17,  
"successful": 17  
},  
"snapshot": "snapshot-201804140101"

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [October 4, 2018, 11:16am UTC](https://discuss.elastic.co/t/display-nested-rows-in-kibana/150925/2 "2018-10-04T11:16:23Z")

</div>

There haven't been any changes in this regard in Kibana, so the most you could do is to follow what has been suggested here:

> [@Getting around Kibana's missing support for Nested Objects & Parent/Child](https://discuss.elastic.co/t/getting-around-kibanas-missing-support-for-nested-objects-parent-child/53529/16):
>
> @3ygun To answer your first need, you could do that with Elastic Stack, using Parent/Child model. In Kibana, when you create your visualization, you can copy that in "search bar" : { "has\_parent": { "parent\_type": "kitchen", "query": { "query\_string": { "query": "type:old" } } } } And then make a term aggregation based on "model" field, then order by "custom metric", which is sum of 'count' field. This works for me in Kibana 4.6.3 and Kibana 5.0.1

---

<div class="post-metadata">

**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\
**Post date:** [October 4, 2018, 11:43am UTC](https://discuss.elastic.co/t/display-nested-rows-in-kibana/150925/3 "2018-10-04T11:43:57Z")

</div>

Well, my suggestion works only for parent/child structure.

By the way, with 6.x, you can click on "Add a filter", then "Edit Query DSL", and you can inject here a parent/child filter.

But to my known, nested objects are clearly not supported in Kibana.

---

<div class="post-metadata">

**Author:** ![frankfoti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankfoti/32/26965_2.png) [@frankfoti](https://discuss.elastic.co/u/frankfoti)\
**Post date:** [October 4, 2018, 12:07pm UTC](https://discuss.elastic.co/t/display-nested-rows-in-kibana/150925/4 "2018-10-04T12:07:11Z")

</div>

Great Thanks, I will need to come up to speed on the parent/child structure that is new to me as well as "Edit Query DSL". As a current work around I changed to a "cat" http\_poll but results in a single resulting Document. For now that is useful to display the latest snapshot on the dashboard. Then a second index will provide the "list" of all snapshots as a single text field. All OK for now.

input {  
http\_poller {  
urls =\> {  
snapshot3 =\> {  
# Supports all options supported by ruby's Manticore HTTP client  
method =\> get  
url =\> "http://_._._._:9200/\_cat/snapshots/production-elasticsearch2-bck/?v&s=end\_epoch&pretty"  
headers =\> {  
Accept =\> "application/json"  
}  
}  
}  
keepalive =\> false  
request\_timeout =\> 180  
socket\_timeout =\> 180  
# Supports "cron", "every", "at" and "in" schedules by rufus scheduler  
schedule =\> { cron =\> "01 2 \* \* \* UTC"}  
codec =\> "json"  
# A hash of request metadata info (timing, response headers, etc.) will be sent here  
#metadata\_target =\> "http\_poller\_metadata"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["cloudcontrol-elasticsearch1.office.re.local:9200"]  
index =\> "elasticsearch-backup-current"  
document\_type =\> "backup"  
document\_id =\> "rrc102-production"  
}  
}

---

<div class="post-metadata">

**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\
**Post date:** [October 4, 2018, 1:40pm UTC](https://discuss.elastic.co/t/display-nested-rows-in-kibana/150925/5 "2018-10-04T13:40:48Z")

</div>

In the full elasticsearch way, you can flatten your docs and set all common attributes on all documents.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2018, 1:40pm UTC](https://discuss.elastic.co/t/display-nested-rows-in-kibana/150925/6 "2018-11-01T13:40:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.