Elastic query for multiple level (more than 3) parent child relation

Elastic Stack Elasticsearch
1

Suppose I have the following structure:

"audit_ssn" : {          
  "properties" : {
    "session_id" : {
      "type" : "string"
     },
     "user":{
        "type" : "nested",
        "properties" : {
          "id": {
             "type" : "string"
          },
          "first_name" : {
             "type" : "string"
          }
        }
     }
  }
},
"audit_trn" : {        
  "_parent" : {
     "type" : "audit_ssn"
  },
  "properties" : {
     "session_id" : {
        "type" : "string"
     },
     "trans_seq_no" : {
        "type" : "string"
     },
     "task_id" : {
        "type" : "string"
     }
  }
},

"audit_table" : {       
  "_parent" : {
     "type" : "audit_trn"
  },
  "properties" : {
     "session_id" : {
        "type" : "string"
     },
     "trans_seq_no" : {
        "type" : "string"
     },
     "table_seq_no" : {
        "type" : "string"
     },
     "table_name" : {
        "type" : "string"
     }
  }
},
"audit_field" : {
   "_parent" : {
     "type" : "audit_table"
   },
   "properties" : {
     "session_id" : {
        "type" : "string"
     },
     "trans_seq_no" : {
        "type" : "string"
     },
     "table_seq_no" : {
        "type" : "string"
     },
     "field_id" : {
        "type" : "string"
     },
     "field_name" : {
        "type" : "string"  
     },
     "old_value" : {
       "type" : "string"
     },
     "new_value" : {
       "type" : "string"
     } 
   }
}

I have above structure for audit of my system, in each session, may occur more than one transaction, each transaction may change more than one table, and each table may have more than one field.

In indexing time after audit_ssn is indexed, i use from parent:audit_ssn.id for index of audit_tr, after that i use from parent:audit_tr.id, and routing:audit_ssn.id for index of audit_table, and at the end i use from parent:audit_table.id, and routing:audit_ssn.id for indexing of audit_field,

every thing is ok but when i search for audit_table and tell to the query that has_child no result is returned.

GET my_index/audit_table/_search 
{
   "query": {
      "has_child": {
         "type": "audit_field",
         "query": {
            "match_all": {}
         }
      }
   }  
}

What is wrong with me in index of fourth level child ? and any idea about this structure, and alternate ways.

2

Parent-child relationships can be quite useful when you have a parent that changes relatively frequently and you want to avoid updating large number of children. In this case it seems most entities are static and will not change, which makes me suspect you are using parent-child relationships trying to replicate a relational data model. Have you considered denormalising your data model in order to simplify it? This would allow you to alter your document structure to fit how you want to search it without having to use potentially more costly parent-child queries.

3

Thanks! I will try to do it with denormalising.
But I don't know why all the childs after 3rd level can't be accessed by has_child query ?

If i run this query, no result returned, but for all other types (audit_ssn,audit_trn,and audit_table ) it works.
GET promote_kmp/audit_table/_search { "query": { "has_child": { "type": "audit_field", "query": { "match_all": {} } } } }